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PREAMBLE 


This report presents the results of the lAEA Operational Safety Review Team (OSART) 
review of EPZ-Borssele Nuelear Power Plant, Netherlands. It ineludes recommendations for 
improvements affecting operational safety for eonsideration by the responsible Netherlands 
authorities and identifies good praetiees for eonsideration by other nuelear power plants. 
Eaeh reeommendation, suggestion, and good praetiee is identified by a unique number to 
facilitate eommunication and tracking. 

Any use of or referenee to this report that may be made by the eompetent Netherlands 
organisations is solely their responsibility. 




FOREWORD 


by the 

Directer General 

The lAEA Operational Safety Review Team (OSART) programme assists Member States to 
enhance safe operation of nuclear power plants. Although good design, manufaeture and 
construction are prerequisites, safety also depends on the ability of operating personnel and 
their eonscientiousness in diseharging their responsibilities. Through the OSART programme, 
the lAEA facilitates the exchange of knowledge and experience between team members who 
are drawn from different Member States, and plant personnel. It is intended that sueh adviee 
and assistance should be used to enhanee nuclear safety in all countries that operate nuclear 
power plants. 


An OSART mission, carried out only at the request of the relevant Member State, is directed 
towards a review of items essential to operational safety. The mission can be tailored to the 
particular needs of a plant. A full scope review would cover ten operational areas: 
management, organisation and administration; training and qualification; operations; 
maintenance; technical support; operating experience feedback; radiation protection; 
chemistry; emergency plarming and preparedness; and severe accident management. 
Depending on individual needs, the OSART review can be directed to a few areas of special 
interest or cover the full range of review topics. 

Essential features of the work of the OSART team members and their plant counterparts are 
the comparison of a planfs operational practices with best international practices and the joint 
search for ways in which operational safety can be enhanced. The lAEA Safety Series 
documents, including the Safety Standards and the Basic Safety Standards for Radiation 
Protection, and the expertise of the OSART team members form the bases for the evaluation. 
The OSART methods involve not only the examination of documents and the interviewing of 
staff but also reviewing the quality of performance. It is recognized that different approaches 
are available to an operating organisation for achieving its safety objectives. Proposals for 
further enhancement of operational safety may reflect good practices observed at other 
nuclear power plants. 

An important aspect of the OSART review is the identification of areas that should be 
improved and the formulation of corresponding proposals. In developing its view, the 
OSART team discusses its fmdings with the operating organisation and considers additional 
comments made by plant counterparts. Implementation of any recommendations or 
suggestions, after consideration by the operating organisation and adaptation to particular 
conditions, is entirely discretionary. 



An OSART mission is not a regulatory inspection to determine compliance with national 
safety requirements nor is it a substitute for an exhaustive assessment of a plant's overall 
safety status, a requirement normally placed on the respeetive power plant or utility by the 
regulatory body. Eaeh review starts with the expeetation that the plant meets the safety 
requirements of the country concemed. An OSART mission attempts neither to evaluate the 
overall safety of the plant nor to rank its safety performance against that of other plants 
reviewed. The review represents a 'snapshot in time'; at any time after the completion of the 
mission care must be exercised when considering the conclusions drawn since programmes at 
nuclear power plants are constantly evolving and being enhanced. To infer judgements that 
were not intended would be a misinterpretation of this report. 


The report that follows presents the conclusions of the OSART review, including good 
practices and proposals for enhanced operational safety, for consideration by the Member 
State and its competent authorities. 
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INTRODUCTION AND MAIN CONCLUSIONS 


INTRODUCTION 

At the request of the Duteh nuelear regulatory authority - KFD (inspectorate for nuelear 
safety, radiation proteetion, safeguards and seeurity), an lAEA Operational Safety Review 
Team (OSART) of international experts visited EPZ and the Borssele Nuelear Power Plant 
from 1-18 September 2014. The purpose of the mission was to review: 

- Corporate funetions in the areas of corporate management, support to provide 
human resourees, independent oversight, communieation; 

- Operating praetiees in the areas of Management, organisation and 
administration; Training & qualifieation; Operations; Maintenanee; Teehnical support; 
Operating experience; Radiation proteetion; Chemistry; Emergeney planning and 
preparedness; and Severe aeeident management; 

- The safety eulture of the organization, requested by EPZ with the eonsent of 
KED. The methodology of this safety eulture assessment is deseribed in Annex 1. 

In addition, an exehange of teehnical experience and knowledge took place between the 
experts and their plant counterparts on how the common goal of excellence in operational 
safety could be further pursued. 

The Borssele OSART mission was the 178th in the programme, which began in 1982. The 
team was composed of experts from Canada, Czech Republic, France, Germany, Hungary, 
Slovakia, Slovenia, Spain, the United Kingdom, the United States of America and the lAEA 
staff members. The collective nuelear power experience of the team was approximately 370 
years. 

Before visiting the plant, the team studied Information provided by the lAEA and the EPZ- 
Borssele nuelear plant to familiarize themselves with the plant's main features and operating 
performance, staff organisation and responsibilities, and important programmes and 
procedures. During the mission, the team reviewed many of the planfs programmes and 
procedures in depth, examined indicators of the plant's performance, observed work in 
progress, and held in-depth discussions with plant personnel. 

Throughout the review, the exehange of information between the OSART experts and plant 
personnel was very open, professional and productive. Emphasis was placed on assessing the 
effectiveness of operational safety rather than simply the content of programmes. The 
conclusions of the OSART team were based on the plant's performance compared with best 
international praetiees. 

The following report is produced to summarize the fmdings in the review scope, according to 
the OSART Guidelines document. For those fmdings related to Borssele nuelear power plant 
the term “plant” is used; For those findings related to the EPZ organisation including the 
nuelear plant then the term “organisation” is used. The text reflects only those areas where 
the team considers that a Recommendation, a Suggestion, an Encouragement, a Good 
Practice or a Good Performance is appropriate. In all other areas of the review scope, where 
the review did not reveal further safety conclusions at the time of the review, no text is 
included. This is reflected in the report by the omission of some paragraph numbers where no 
text is required. 
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MAIN CONCLUSIONS 


The OSART team concluded that the managers of EPZ - Borssele NPP are committed to 

improving the operational safety and reliability of their plant. The team found good areas of 

performance, including the following: 

- EPZ has a risk management offïcer who is responsible for development and 
control of integral risk management within the organization of EPZ. Integral risk 
management is the umbrella for all types of risks; 

- The establishment of Young EPZ Professionals as a response to rapid 
demographic changes; 

- Process maturity model for monitoring the progress and improvement of the 
integrated management system; 

- The plant organizes six site-wide integrated exercises each year to ensure that 
all persormel with assigned duties during an emergency participate in an exercise each 
year; 

- Requirements for Severe accident management (SAM) equipment in separate 
Plant Technical Specifications. 

The team found also a number of areas in need of improvement to enhance operational safety 

performance. The most significant ones include the following: 

- Leadership for safety is not recognized throughout the organization to ensure 
sustainable safety performance; 

- The change management process is not effectively used to support changes in 
the organization; 

- An effective Human Performance Programme has not been implemented; 

- Expectations are not systematically being met by plant personnel nor 
reinforced by managers and supervisors, and some of them are not yet set; 

- The plant’s expectations and work management process are not robust enough 
to ensure effective personnel resource usage, completion of risk reviewed work, and safe 
work Schedule stability; 

- High standards of material condition in some plant areas are not consistently 
maintained; 

- The process for temporary modifications does not provide adequate 
arrangements for their review, approval or control, to ensure that temporary modifications 
are handled in a safe manner; 

- Analysis for some events has not been performed adequately to ensure that the 
root cause is identified and are not consistently completed in a timely marmer; 

- The plant workers and line management do not always take responsibility for 
ensuring their own or team’s radiation protection and are not held accountable when the 
required radiation protection behaviours and work practices are not achieved; 

- The on-site emergency arrangements are not sufficiënt to ensure the timely 
protection of on-site workers in the event of an emergency; 

- The plant’s abnormal operation procedures and EOPs are incomplete and do 
not address the scope of all credible plant States. 
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EPZ senior management and Plant management expressed a determination to address the 
areas identified for improvement and indicated a willingness to aeeept a follow up visit in 
about eighteen months. 
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1. MANAGEMENT, ORGANISATION AND ADMINISTRATION 

1.1 ORGANISATION AND ADMINISTRATION 

Some documents describing the organisational chart have not been updated sinee 2009, and 
some job deseriptions have been reviewed very reeently, although the organisational ehanges 
took plaee more than one year ago. The implementation of the Nuclear Safety Seetion was 
undertaken without performing a preliminary safety evaluation due to time pressure. The 
team eneourages the plant to inelude the doeumentation updates in the planning for 
organisational ehanges. 

The funetions and responsibilities of proeesses owners and leaders are not deseribed. Senior 
managers have been appointed as sponsors for SOERs, but their role is still to be defined. The 
team eneourages the plant to develop and communieate the funetions and responsibilities of 
the staff involved in proeess management or aeting as sponsors in any area. 

1.2 MANAGEMENT ACTIVITIES 

The team observed weaknesses in the implementation of the plant’s Human Performanee 
programme, sueh as laek of resourees, aetions from the implementation plan being late and 
no traeking of its effectiveness by management. The team reeommends the plant undertakes 
the effeetive implementation of a Human Performanee programme and ensures that it is 
suffieiently staffed and eontinuously improved. 

The plant has developed a proeess maturity model for easy and timely eommunication on the 
developments and improvement of the integrated management system. The team eonsiders 
this as a good praetiee. 

There is no systematie and formal review of the effeetiveness of eommunieations undertaken 
by the organisation, such as surveys, interviews or assessments. The team eneourages the 
organisation to develop an effeetiveness review of its main eommunieations in order to cheek 
that messages reaeh the intended reeipient and are properly understood. 

1.3 MANAGEMENT OF SAFETY 

The team observed examples of the organisation responding reactively in some of the 
programmes or proeesses for whieh no aetions have been undertaken until performanee has 
deereased (e.g. SOER implementation, safety eulture improvement, work management and 
eorreetive aetion programme). The team reeommends the plant implement the neeessary 
tools, programmes, monitoring and trending Systems to ensure that a comprehensive and 
effective Integrated Management System is used to manage and eontinuously improve 
performanee. 

Some examples of deviations from the plant’s standards and expectations were observed 
during plant tours or observations performed by the team. Some expectations in the radiation 
protection area were not set. Signs of a non-challenging attitude among managers and 
supervisors were detected. The team recommends the plant ensures that expectations are set 
and being met by plant personnel and reinforced by managers and supervisors. 

The Integrated Management System (IMS) Handbook does not describe the graded approach 
used to prioritize the improvements needed in the system itself and on the activities within its 
scope. The satisfaction of stakeholders or interested parties assessment is not included within 
the IMS scope and there is no formal management review of the overall IMS. The team 
encourages the plant to develop its IMS in order to cover all these aspects. 
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1.4 QUALITY ASSURANCE PROGRAMME 

Nuclear-grade items, products and services are qualified through the German VGB group list 
(audits of suppliers by other plant’s QA are accepted). This list might not be available after 
the phase out of the German plants in 2022. The organisation does not perform audits to 
approve suppliers that provide nuclear-grade equipment or services and are not in the VGB 
list. Even though the cause of an unplaimed outage was a weakness in the quality system of a 
supplier (it did not configure a design change and supplied a rotor that was not suitable), QA 
has not undertaken any additional independent check or audit on this supplier. The team 
encourages the organisation to plan the necessary arrangements in order to ensure that the 
necessary audits and inspections are performed on nuclear-grade suppliers in the long-term. 

1.6 DOCUMENT AND RECORDS MANAGEMENT 

The site process for procedures (working instructions) requires review and approve by the 
line manager and then by the department manager. For various reasons this can mean that the 
reviewer may have no technical knowledge of the area covered by the procedure, when in 
some cases it may be more appropriate to ask a peer to undertake the review. For example, a 
radiological protection (RP) procedure for the calibration of RP instrumentation is reviewed 
by two people without specific knowledge of what is involved. The team encourages the plant 
to ensure that safety procedures are reviewed by personnel with appropriate technical 
knowledge. 
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DETAILED MANAGEMENT, ORGANISATION AND ADMINISTRATION 

FINDINGS 


1.2. MANAGEMENT ACTIVITIES 

1.2(a) Good Practice: Process maturity model for monitoring the progress and 
improvement of the integrated management system. 

EPZ has developed a proeess maturity model. lts main purpose is to make communieation 
about the status of a (eomplex) Integrated Management System (IMS) easy and to help 
proeess owners and management improve the management system. 

The maturity model is a powerful tooi beeause: 

- It serves as a eommon reference for talking about processes, whieh makes 
eommunieation about the status of the IMS easier; 

- It helps to create awareness about the gaps within the IMS; 

- It shows whieh aspeets of a proeess need the most improvement; 

- It stimulates proeess ownership; 

- It helps to make objeetives SMART and to make progress visible. 

The model is based on six areas that are key for any proeess: proeess ownership, proeess 
performanee, proeess risk eontrol, proeess eomplianee, process structure and process 
execution. For each area the maturity level is determined periodically. Characteristics of the 
levels are: 

- Not present; 

- Activities are only done when necessary; 

- Activities are done but not organized as a process; 

- The process is well organized and executed; 

- Pro-active behaviour and continuous improvement are normal. 

In December 2012 two internal auditors assessed twenty processes. The average maturity 
level of the assessed processes was 3.1. This was communicated to the senior and middle 
management and created the awareness and sense of urgency required to start the IMS 
improvement project that is currently on-going. Now the maturity of a process is assessed 
during the execution of internal audits and progress is monitored and reported by the Quality 
Assurance Department. 

Currently the average process maturity level (same processes as in 2012) has increased to 

3.3. The best example of a single process improvement is the ICT process: 2.2 (Dec. 2012), 
2.5 (Sept. 2013) and 3.6 (July 2014). 
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1.2(1) Issue: An effective Human Performance Programme has not been implemented. 

The following observations were made: 

- A plan for the implementation of the HP programme was approved by the 
interim Plant Manager in May 2013.The required resources are not in place; 

- The HP programme has no metrics to measure effectiveness; 

- Approximately 50% of the actions to implement the HP programme are 
postponed; 

- Supervisors are expected to provide informal and verbal feedback to managers 
about what they observe in the plant. They are only expected to make a formal report 
when something significant happens. Due to this, no reporting data is available for 
trending, evaluation or setting improvement actions; 

- Only 24 selected people have been trained as HP-leaders two years since the 
programme was initiated; the training of more HP Leaders is progressing slowly; 

- Expected personal behaviours for leaders, supervisors and employees are 
neither defined nor systematically reinforced; 

- The Maintenance Division has 4 indicators for leadership and safety culture. 
AU of them are associated with the revision status of documents and procedures; 

- Managers of the plant stated during the interviews that leadership is not 
demonstrated in the field mainly due to the volume of work that managers must perform 
in their offices; 

- The plant observation programme focuses on plant status and condition rather 
than on personal behaviours. No feedback on behaviours is provided in the quarterly 
reports from Class Base or the semi-annual report of WANO observations; 

- Task observations are not included in the station toolbox for HP; 

- Human Performance is not being tracked by the plant’s annual plan and it is 
not a focus area of the company’s business plan; 

- Deviations observed during plant tours are assigned to the department 
responsible for their resolution. There is no follow up by management and no 
improvement actions are established as a result of the overall program assessment; 

Interview with field operator and review of walk down report: 

- The Operator had two walk downs with managers in last three month. Only 
housekeeping and technical details were addressed by the managers during the walk 
downs. None of the Human Performance expectations, listed in the “red booklet”, were 
addressed; 

- A review of the latest report, submitted by a manager following his walk down 
with field operator contains only 2 comments, both technical. Human Performance of the 
operator mentioned; 

- The team identified that Human Performance and Safety Culture (HPSC) 
topics are integrated into training programs for Field Operators, HPSC topics are included 
in the exit test. There is a procedure A09-26-N009 “Human Performance Techniques for 
employees”. The “Learning goals for the Control Room Simulator (CRS)” PO A 11-23- 
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009 include the use of Human Error Prevention Tools (HEPT) at CRS. However, the 
observations and interview revealed the following; 

- Field operators only partially receive training in HEPT (elassroom training 
only) as they are not part of CRS training; 

- Management expectations, recorded in a booklet for plant personnel, require 
use of 3 way eommunication when performing activities in step-by-step proeedure, 
switching “ON” or “OFF” equipment, or eommunicating equipment statuses (“opened/ 
elosed”), hut in an interview plant operators stated that 3 way eommunication has to be 
used only in a real emergency or in case of misunderstanding, caused, for example, by 
noisy environment; 

- Some managers stated that use of HEPT needs reinforcement, for example by 
proper coaching in the field; 

- Records of trainer’s comments/ post job critique after specific CRS session are 
not available, formal protocols of CRS training “Jahresgesprach” reflect very good use of 
HEPT by operators during CRS sessions, which contradicts the real performance of MCR 
and field operators observed during Safety Systems test. 

Interview with OE department head and review of OE documentation: 

- 77 events out of 79 analysed during 2013 are identified as caused by Human 
Factors, 57 of which are related to OPS practices; 

- When asked why OE is not included in the pre-job briefing (PJB) for 
surveillance tests of safety Systems and not addressed by plant operators during their PJB, 
an OE manager replied that this is also their concern and expectations to use OE have to 
be reinforced; 

- Review of the latest INES Eevel 1 event report (Event 13/004) - Electrical 
short in DA Busbar during insulation resistance measurement (0,4 kV, Safety Busbar) led 
to Reactor transfer to Mode 5 (Cold shutdown) - caused by a chain of human 
performance shortfalls, including: 

- Potential for mistake was not discussed in PJB; 

- Lack of attention; 

- Lack of questioning attitude; 

- Lack of self-assessment; 

Without implementing of an effective Human Performance programme the probability of 
events caused by undesired behaviours may increase. 

Recommendation: The plant should undertake the effective implementation of a Human 
Performance programme and ensure that it is suffïciently resourced and continuously 
improved. 

lAEA Bases: 

SSR-2/2 

3.5. The management system shall integrate all the clements of management so that processes 
and activities that may affect safety are established and conducted coherently with other 
requirements, including requirements in respect of leadership, protection of health, human 
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performance, protection of the environment, security and quality, and so that safety is not 
compromised by other requirements or demands. 

4.29. Aspects of the working environment that influence human performance factors (such as 
work load or fatigue) and the effectiveness and fitness of personnel for duty shall be 
identified and controlled. Tools for enhancing human performance shall be used as 
appropriate to support the responses of operating personnel. 


NS-G-2.4 

6.61. A suitable working environment should be provided and maintained so that work can 
be carried out safely and satisfactorily, without imposing unnecessary physical and 
psychological stress on personnel. Human factors which influence the working environment 
and the effectiveness and fitness of personnel for duty should be identified and addressed. 
The operating organisation should establish an appropriate programme for these purposes. 
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1.3. MANAGEMENT OF SAFETY 


1.3(1) Issue: A comprehensive and effective Integrated Management System (IMS) has not 

been applied to manage and continuously improve performance. 

The following observations were made: 

- 54% of processes have a maturity level in their “Execution Phase” ranked as 3 
(on a scale from 1 to 5) or lower, meaning that they have a “reactive response on 
deviations”; 

- Only one of the SOERs that were identified in the last WANO Peer Review 
(2012) as “requiring further action” has been re-evaluated. Around 50% of the SOER’s 
recommendations required further action; 

- Operations and Maintenance KPIs do not develop all the plant’s KPIs. They 
are not always specified at the shift/department level, thus losing an opportunity to be 
used as an accountability tooi. Maintenance has no intemal measures for some critical 
activities such as pre-job briefs, post-job debriefs or supervisor observations; 

- The company has no active multidisciplinary teams systematically working on 
continuous improvement of the processes unless it is required for the management. For 
2014, four teams were working to improve the existing processes (work package 
preparation, improvements in the work permits process, financial investments projects 
and fuel management); 

- Some of the main processes have no KPIs (e.g. equipment reliability, 
emergency preparedness, portfolio management) to determine their efficiency; 

- There is no global and shared vision among the managers of the results 
achieved by each of the processes; 

- No metrics or tracking system have been established to measure progress of 
the work management implementation project; 

- In 2013, 17 process owners were requested by the management team to 
develop a project plan to improve their processes. This request was not met due to lack of 
sponsorship; 

- The status of the armual plans is not formally reported during the year to the 
corporate management; 

- The Integrated Management System does not require a management review of 
its performance and effectiveness; 

- Post job debriefs are not implemented at the site, although they are part of the 
management expectations; 

- There is no plan for embedding the continuous improvement of safety culture 
in the organisation once the project FOCUS-3 is fmished (December 2014); 

- Senior managers are not knowledgeable about the progress of the FOCUS-3 
project; 

- The KPIs of the plant divisions are lagging indicators. Leading indicators are 
missing. As an example for RP: contamination events per entry to RCA, dose (CRE), total 
solid waste volume and activity and liquid discharges; 
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- Overdue corrective actions show adverse trend. Currently 29.6% of corrective 
actions are late; 

- The backlog of work orders is 1846, and it has been increasing over the last 
four months; 

- Without a comprehensive and effective Integrated Management System to 
manage and continuously improve performance, the plant does not have the opportunity 
to act to prevent a negative impact or events affecting the safety of the installation; 

Recommendation: The plant should implement the necessary tools, programmes, 
monitoring and trending Systems to ensure that a comprehensive and effective Integrated 
Management System is used to manage and continuously improve performance. 

lAEA Bases: 

SSR-2/2 

4.5. The safety policy of the operating organisation shall include a commitment to achieving 
enhancements in operational safety. The strategy of the operating organisation for enhancing 
safety and for fmding more effective ways of applying and, where feasible, improving 
existing standards shall be continuously monitored and supported by means of a clearly 
speellied programme with clear objectives and targets. 


GS-R-3 


2.1. A management system shall be established, implemented, assessed and continually 
improved. It shall be aligned with the goals of the organisation and shall contribute to their 
achievement. The main aim of the management system shall be to achieve and enhance 
safety by: 

- Bringing together in a coherent manner all the requirements for managing the 
organisation; 

- Describing the planned and systematic actions necessary to provide adequate 
confidence that all these requirements are satislled; 

- Ensuring that health, environmental, security, quality and economie 
requirements are not considered separately from safety requirements, to help preclude 
their possible negative impact on safety. 

3.1. Management at all levels shall demonstrate its commitment to the establishment, 
implementation, assessment and continual improvement of the management system and shall 
allocate adequate resources to carry out these activities. 

NS-G-2.4 

1.3. The attention to be paid to safety requires that the management recognize that personnel 
involved in the nuclear power programme should understand, respond effectively to, and 
continuously search for ways to enhance safety in the light of any additional requirements 
socially and legally demanded of nuclear energy. This will help to ensure that safety policies 
that result in the safe operation of nuclear power plants are implemented and that margins of 
safety are always maintained. The structure of the organisation, management standards and 
administrative Controls should be such that there is a high degree of assurance that safety 
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policies and decisions are implemented, safety is continuously enhanced and a strong safety 
culture is promoted and supported. 
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GS-G-3.1 


2.36. A strong safety culture has the following important attributes: (...)Aproactive and long 
term approaeh to safety issues is shown in deeision making. 

6.76. (...) A proeess for preventive actions should take proaetive steps to ensure that a 
potential non-eonformanee does not oceur. 

GS-G-3.5 

2.10. Senior management should establish and promote a set of principles to be used in 
deeision making and promoting safety eonseious behaviour. Examples of sueh prineiples 
used in some organisations are as follows: (...) (i) Aproaetive approaeh to safety is taken. 

2.27. To prevent a signifieant degradation of safety, a proaetive approaeh to the management 
of safety and safety culture should be established so that any problem may be deteeted and 
aeted upon at an early stage. 
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1.3(2) Issue: Expectations are not systematically being met by plant personnel nor 

reinforced by managers and supervisors, and some of them are not yet set. 

The following observations were made: 

- Supervisors are not systematieally reporting issues regarding organisational or 
behavioural aspects observed in the field; 

- The Operations Division has no formal feedback of the results of observations 
performed by shift supervisors or shift managers. There is no information about how 
many observations are performed, what the conclusions are, and the role of the shift 
manager in them. As a result, no actions are taken; 

- Several deviations in scaffolding were identified by the team during the plant 
inspections; 

- The Managers in the Field programme shows a decreasing participation in 
several areas down to 53 %. Two of the managers do not participate although they are in 
the programme; 

- A person with no personal protection equipment was observed walking 
through an exclusion area when the reception of fuel clements was taking place; 

- The job description for supervisors does not include functions or 
responsibilities for the training of their teams; 

- A person was observed working in a workshop with a power saw without 
safety glasses or ear protection, as required by the signs on the entrance door. When 
highlighted by the reviewer, the person escorting him did not take any action and the 
reviewer was the one that challenged the behaviour; 

In the area of radiation protection, the following was observed: 

- Expectations for worker behaviour in the radiation controlled area (RCA) are 
not set or reinforced by line management; 

- Expectations for dose reduction are set at management level, but are not 
visible to the working teams; 

- Eocal rules do not contain all of the required information and are not well 
known by the plant workers; 

- RCA clearance monitoring routinely identifies unanticipated contamination 
above action levels on items and equipment and these events are not recorded or trended; 

- Contaminated items found inadequately wrapped and with no labelling for 
radiological results nor ownership, there is no specified Standard for this; 

- There is no site owned procedure for the control of Radiography; 

- There is no training or standards for RP staff on how to apply shielding or to 
fix signage to it; 

- There is no checking, coaching or observation programme for workers 
entering the RCA to ensure compliance with local rules; 

- Contaminated clothing bins and clean clothing storage racks are observed to 
be located on different sides of the step-over barrier, not in line with a Standard approach; 


MANAGEMENT, ORGANIZATION AND ADMINISTRAUON 
14 



- Persons do not always use the hand & foot monitors after exiting 
eontamination eontrolled areas as required by the plant. 

The team noted the following during observation of safety diesel Nol test: 

- No cheek list was used for the pre-job briefing (PJB); 

- The PJB eovered teehnieal aspeets of test proeedure only. No OE or safety 
aspects were addressed; 

- After the eompletion of the PJB, an electrieian eame to MCR to check the 
execution of the test. He did not participate in the PJB; 

- No 3-way communication was used during the test, even though management 
expectations clearly require use of three way communication for safety related activities. 

Without expectations being set and systematically met by plant personnel and reinforced by 
managers and supervisors, undesired personal or organisational behaviours and practices 
could take place at the plant and result in a risk for individuals and for the installation. 

Recommendation: The plant should ensure that expectations are set and systematically met 
by plant personnel and reinforced by managers and supervisors. 

lAEA Bases: 

SSR-2/2 

4.2. The safety policy shall stipulate clearly the leadership role of the highest level of 
management in safety matters. Senior management shall communicate the provisions of the 
safety policy throughout the organisation. Safety performance standards shall be developed 
for all operational activities and shall be applied by all site personnel. All personnel in the 
organisation shall be made aware of the safety policy and of their responsibilities for 
ensuring safety. The safety performance standards and the expectations of the management 
for safety performance shall be clearly communicated to all personnel, and it shall be ensured 
that they are understood by all those involved in their implementation. 

NS-G-2.4 

3.16. This is part of a manager’s role in setting the standards and expectations for all staff in 
all aspects of safe management of a plant. In addition, managers themselves should visibly 
meet these standards and should help staff to onderstand why they are appropriate. 


GS-G-3.1 


2.17. Managers and supervisors should talk to other individuals during workplace tours and 
should take these opportunities to reinforce awareness of management expectations. 
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GS-G-3.5 


6.3. Managers normally perform oversight reviews and assess the performanee of aetivities 
through their day-to-day line management aetivities. Other, more struetured meehanisms 
include: 


Line management monitoring: In order to beeome proactive and to maintain 
control over emerging problems, line managers and supervisors should be aware of what 
is going on in their areas of responsibility and should assess aetual performanee against 
expeeted results. Line management monitoring neeessitates that managers be individually 
involved in assessing the performanee of work, posing informed and probing questions 
and reviewing the results of work eompleted. To achieve these objectives, line managers 
and supervisors; 

Should observe the work being earried out to ensure that the applieable 
standards are being met; 

Should be visibly present and available and should listen to suggestions and 
complaints from persormel; 

Should examine trends in performanee indicators; 

Should review the results and lessons to be leamed from self-assessments, 
independent assessments, observation and surveillance programmes; 

Should carry out pre-job briefings and post-job briefings where necessary; 

Should coach and mentor individuals to improve their performance. 
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2 . 


TRAINING AND QUALIFIC ATIONS 


The organisation lacks an overall quality assured process for staff qualifïeation. Qualifieation 
is understood as a formal document certifying that the employee is fully competent to 
perform the job he/she is assigned to. The policy and process to ensure that all personnel in 
the organisation are competent for the activities they have to perform are not adequate. The 
formalization of the qualification process at the organisation level should ensure structure and 
consistency across the organisation. It could also be extended to main contractors, eventually. 

The plant does not reinforce the ownership and responsibility of operational managers and 
supervisors for both defïning training needs and evaluating personnel competencies in the 
field. The needs and results of managerial observations in the field are not transmitted to the 
training department (TQ) in a written form. The systematic approach to training loop is 
presently not always closed and it is not used in the continuous improvement process. The 
team recommends that the organisation publishes a formal qualification policy and 
implements the corresponding processes. 

2.2 TRAINING FACILITIES, EQUIPMENT AND MATERIALS 

The simulator is not a full-scope simulator as its scope does not include all open vessel 
operations. The nuclear model is presently limited to temperatures less than 700°C. The 
current core model does not take into account the new fuel configuration of the plant (MOX). 
The distance between the simulator and the plant does not allow effective just-in-time 
training on major plant evolutions. 

A project to build a Work Practical Simulator on site (WPS or workshop for practical 
training) approved by the plant management is not yet launched after several years of delay. 
Without such a facility, acquiring effective work practices in a risk-free environment with the 
integration of radiation protection requirements is hampered. The current organisation does 
not facilitate the formalization of all on-the-job training (OJT) activities. 

The team suggests that the organisation provide adequate facilities to ensure that practical 
training (OJT) is effective and documented. 


2.3. QUALITY OF THE TRAINING PROGRAMMES 

All trainee feedback sheets are managed through an independent extemal software company 
(using hand writing recognition), providing within a week, statistics and analysis to the 
relevant instructor and the TQ manager. The team considers this as a good performance. 

2.4 TRAINING PROGRAMMES FOR CONTROL ROOM OPERATORS AND SHIFT 
SUPERVISORS 

An experienced shift manager is integrated in the TQ instructor team to ensure credibility and 
quality of operator training. The team considers this as a good performance. 

The glass simulator helps personnel to visualize physical phenomena during specific 
transients or during training on the industry main events (e.g. TMI accident). It also enhances 
training in thermodynamics and hydraulics. Several training scenarios have been developed 
to provide understanding of the links between plant operations and actual physical 
phenomena. The team considers this as a good performance. 
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2.8 TRAINING PROGRAMMES FOR TRAINERS 


Trainers must have a technieal Baehelors degree to be reeruited. They then have to augment 
their teehnieal experienee with a formal degree in adult education instruetional skills. This 
requirement is ineluded in their individual training plan and it eonstitutes a neeessary 
qualifieation, whieh is to be renewed every five years. Instruetors are qualified (formal 
document) after several course deliveries for which the evaluation mark has to be greater than 
7.5 over 10. The team recognizes this as a good performance. 

2.9 TRAINING PROGRAMMES FOR TRAINING GROUP PERSONNEE 

To reinforce understanding of work constraints from different categories of personnel, the 
organisation has implemented an interdepartmental training support process. For example, an 
experienced operator undertakes shadow training with a maintenance engineer for a full week 
and maintenance personnel (including technicians and mangers) and a few managers in the 
emergency preparedness organisation attend a four-week simulator course. The team 
considers this as a good performance. 

2.10 GENERAE EMPEOYEE TRAINING 

The plant has implemented a specilïc induction programme for newly recruited engineers. 
This is a flexible three-year training programme with a one year possible extension if 
necessary. Along with attending all the basic training courses, the engineer spends six to nine 
months in different departments in which he/she is given a specific project. This project- 
oriented training allows new engineers to familiarize themselves with day-to-day nuclear 
safety requirements as well as the soft skills to lead and manage projects. At the end of the 
programme the engineer makes a choice for his job position, with good organisational 
awareness and knowledge. The team considers this as a good performance. 

DETAIEED TRAINING AND QUAEIFICATION FINDINGS 

2.1. TRAINING POEICY AND ORGANISATION 

2.1(1) Issue: The organisation processes do not consistently ensure that all staff have the 
necessary competencies and formal qualifications for safe operations. 

- No overall qualification policy exists at the organisation level; 

- No formal procedures exist to provide an assessment of the competence of all 

personnel (except Operations-Ops, Training and qualification-TQ and Emergency 

Response Organisation-ERO), including contractor personnel; 

- On-the-job training (OJT) practical training is not always assessed. Therefore, 
Controls are not in place to ensure that radiation protection (RP) and maintenance 
personnel are fully competent; 

- Managers and some supervisors do not evaluate work practices and 

competency deficiencies in the field (tasks observation). Also, there is no requirement for 
them to provide input for training in written form; 

- There is neither formalized OJT, nor formal qualification in the maintenance 
and monitoring departments; 
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A missed re-qualification does not automatically cancel the ERO qualification; 


- There are no RP formal qualifications in the maintenance department, only a 

few basic qualifieations. 

Without adequate processes to consistently ensure eompeteneies and formal qualifieation for 
all staff, the plant cannot ensure competent resources for safety-related tasks. 

Recommendation: The organisation should implement processes to consistently ensure that 
workers have the necessary eompeteneies and formal qualification for safe operations. 

lAEA Bases: 


SSR-2/2 


Requirement 7: Qualification and training of personnel 

The operating organisation shall ensure that all activities that may affect safety are performed 
by suitably qualified and competent persons. 

4.17. Suitably qualified personnel shall be selected and shall be given the necessary training 
and instruction to enable them to perform their duties correctly for different operational States 
of the plant and in accident conditions, in accordance with the appropriate procedures. 


4.18. The management of the operating organisation shall be responsible for the qualification 
and the competence of plant staff. Managers shall participate in determining the needs for 
training and in ensuring that operating experience is taken into account in the training. 
Managers and supervisors shall ensure that production needs do not unduly interfere with the 
conduct of the training programme. 

4.20. Performance based programmes for initial and continuing training shall be developed 
and put in place for each major group of personnel (including, if necessary, extemal support 
organisations, including contractors). The content of each programme shall be based on a 
systematic approach. Training programs shall promote attitudes that help to ensure that safety 
issues receive the attention that they warrant. 


NS-G-2.8 


4.5. The training needs for duties important to safety should be considered a priority, and 
relevant plant procedures, references, resources, tools, equipment and standards should be 
used in the training process to ensure, as far as practicable, that errors, omissions and poor 
practices are not accepted. For these critical duties, the training environment should be as 
realistic as possible, to promote positive carry-over from the training environment to the 
actual job environment. 
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4.8. It should be the responsibility of the plant manager, with reference to each position 
important to safety, to ensure that: 


Training needs are continuously analysed and an overall training programme 
is developed; 

the training unit is provided with all necessary resources and facilities; 

The performance of all trainees is assessed at various stages of the training; 

The effectiveness of the training is evaluated; 

The competence of the persons occupying such positions is periodically 
checked, and continuing training or retraining is provided on a regular basis so that their 
level of competence is maintained; 

In allocating resources, the implementation of training programmes is given 
high priority. 


4.9. The training unit will be responsible for assisting the plant manager in establishing, 
verifying and maintaining the competence of plant staff. Line managers and supervisors 
should be accountable for the qualification of their personnel; they should be involved in 
delïning training needs, evaluating the job performance of personnel, providing feedback to 
the training department and ensuring that the training provided reflects operating experience. 
Managers and supervisors should ensure that production requirements do not interfere with 
the conduct of training programmes. 


4.10. The existence of full time training staff should not relieve plant line managers of their 
responsibility to ensure that their workers are adequately trained and qualilïed. Supervisors 
should recognize and make provision for the training needs of their subordinates. The 
responsibilities and authority of training personnel, as distinct from those of line managers, 
should be clearly defmed and understood. 


4.11. Consideration should be given to enhancing training programmes for staff at ageing 
plants to compensate for losses of personnel due to retirement or job changes and for other 
reasons. Training programmes should also be adapted to accommodate the special technical, 
administrative and operational needs of an ageing plant. 
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2.2. TRAINING FACILITIES, EQUIPMENT AND MATERIAL 


2.2(1) Issue: The existing training facilities do not cover all activities which can impact on 

nuclear and industrial safety. 

The team ohserved the following: 

- The simulator in Essen is limited hoth in scope e.g. no open activities, reactor 
temperature less than 700°C, and in fidelity e.g. differences with actual control room, no 
separate instructor cahinet. It is not representative of the plant main control room; 

- There is no video recording system; 

- There is no extended shutdown state simulation or severe accident capahilities; 

- The simulator facility is located 3.5 hours’ drive from Borssele. This location 
is a barrier to effective use as just-in-time training or validation work; 

- The long term operation of the simulator is at risk due to Germany NPP’s 
shutdown program. There is no approved project for long term operation of the simulator; 

- Not all persormel receive formal practical training in RP. RP requirements are 
not incorporated in work practices. RP OJT is performed in the controlled area and as 
such, caimot be risk free; 

- Human performance and maintenance OJT are mostly performed directly on 
the installation increasing potential risk without always allowing for thorough practical 
leaming process; 

Without effective practical training, the organisation’s personnel carmot demonstrate that they 

can safely perform all required activities in all plant conditions. 

Suggestion: The organisation should consider providing necessary training facilities to cover 

all activities which can impact nuclear and industrial safety. 

lAEA Bases: 


SSR-2/2 


4.24. Adequate training facilities, including a representative simulator, appropriate training 
materials, and technical and maintenance training facilities shall be made available for the 
training of operating personnel. Simulator training shall incorporate training for plant 
operational States and for accident conditions. 


NS-G-2.8 
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6.3. Representative simulator facilities should be used for the training of control room 
operators and shift supervisors. Simulator training should eover normal, abnormal and 
accident conditions. 


6.4. In some States, central training facilities are available and have proved to be beneficial. 
The use of training facilities located in other States may involve the additional need for 
trainees to leam a foreign language and to master different Systems of drawing standards and 
component identification. The use of non-reference plant simulators, on the other hand, 
creates an additional need to ensure, by examination or another method, that trainees are 
aware of the limited usefulness of some of the information given in training on a device with 
an instrument conlïguration and performance characteristics that are different from their 
actual working environment. 
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3. 


OPERATIONS 


3.2 OPERATIONS FACILITIES AND OPERATOR AIDS 

A lot of progress has been made reeently by the plant to properly label the teehnieal Systems 
and components, nevertheless diserepaneies in the labelling praetiees still exist. Several 
different eomponents were found during the OSART plant tour and field observations with no 
labels, illegible labels, hand written labels, other than those authorized by the plant, or labels 
eorrected manually. The OSART team suggests the plant develops more effeetive means of 
identifying and improving eonsisteney of labelling. 

3.4. CONDUCT OF OPERATIONS 

Field operators effeetively monitor equipment and Systems status, and verify that important 
plant parameters support safe operation. Some material eondition and housekeeping 
diserepaneies were reported by the field operators, however others were not. The observed 
field operators walk downs have shown that daily operational praetiees need improvement, 
sueh as reporting minor defieieneies in the field, reducing unmanaged or uneontrolled storage 
areas, and assuring that operator aids are authorized. The OSART team made a suggestion in 
this area. 

3.5 WORK AUTHORIZATIONS 

The plant developed a proeess to verify that clearance boundaries are intaet, system is 
deenergized, and that plant eonditions will support safe completion of planned work. An 
added benefit of this proeess is improved teamwork at the plant, as involved work groups 
verify eonditions together. This is eonsidered as a good performance. 

Field operations, plant meetings and interviews were conducted at the plant, and the team 
found that the work management proeess is not being efficiently implemented. Performance 
areas needing improvement are effeetive use of personnel resources, work Schedule stability, 
and completion of risk reviewed work. The team recommends that the plant reinforce its 
expectations, and improve the work management proeess to ensure that personnel resources 
are used more effeetively, improve work Schedule stability, and complete the risk reviewed 
work plan more consistently. 

3.6 FIRE PREVENTION AND PROTECTION PROGRAM 

The plant exhibits good performance in the areas of training fire fighters at the plant and 
offsite with local fire departments, and performing a site exercise for all firefighting 
personnel each year. Areas that need performance improvement are personnel behaviours 
involving the use of fire doors, ensuring that all safety impacts are evaluated prior to 
propping open fire doors, accounting for combustible loading in areas containing plant safety 
equipment, and assessing the aggregate impact of all fire system defieieneies to ensure that 
the plant wilI be able to combat a fire successfully. The team recommends that the plant 
reinforce its expectations, and improve the fire protection program, to ensure that personnel 
behaviours are improved, fire door authorizations are more robust, and safety system integrity 
is not compromised. 
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DETAILED OPERATIONS EINDINGS 


3.2. OPERATIONS FACILITIES AND OPERATOR AIDS 

3.2(1) Issue: Eabelling of plant equipment is not consistent in supporting plant operational 
personnel in proper identification of plant installed eomponents. 

Although a lot of effort was spent recently by the plant to properly label the technical Systems 
and eomponents, diserepaneies in the labelling practice still exists. 

Several different eomponents were found during the OSART plant tour and field observations 
with no labels, illegible labels, hand written labels, other than those authorized by the plant, 
or labels correeted manually. Some examples are indicated below: 

Plant walk down: 

- AU three safety diesels EYOIO, 020 and 030D00I have handmade labelling of 
I&C cables; 

- Eabel of RL023S032 (emergeney feed water valve) on I&C cabinet in 05/314 
room is partially hand-written on a pieee of paper; 

- Room 02.141: HPSI pump TJ043D00I - 6kV cable is hand-written marked 
“2BV0”; 

- Room 02.302 (Reaetor Coolant Pump’s (RCP) oil System) - graffiti labelling 
of valves; 

- Room 02.317. HPSI and TV Systems - graffiti labelling of Containment pipe 
penetrations; 

- Room 02.313, RCP oil System, safety valves YD002S0I7 and YD002S0I8 
have a paper stieker with hand written number ”6” and “5” correspondingly. Operations 
say they should be removed. 

Ineonsistent labelling can lead to potential operational errors. 

Suggestion: Consideration should be given to reinforee and speed up the process of proper 
identification of plant’s installations in order to eliminate labelling defieiencies of plant 
eomponents. 

lAEA Bases: 

SSR-2/2 

7.12. The operating organisation shall be responsible for ensuring that the identification and 
labelling of safety equipment and safety related equipment, rooms, piping and instruments are 
accurate, legible and well maintained, and that they do not introduee any degradation. 
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NS-G-2.14 
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5.2. The labelling standards used should be such as to ensure that the labels are suitable for 
the environmental eonditions in the loeation in which they are to be mounted and that the 
equipment can be unambiguously identilïed. The format and plaeement of labels should allow 
the operators to identify the eomponent quiekly and easily and should prevent the easy or 
inadvertent removal or misplacement of labels.3.4. CONDUCT OF OPERATIONS 

3.4(1) Issue: The plant does not have suffieiently demanding arrangements for daily 
operational praetiees, such as reporting minor deficiencies in the field, unmanaged or 
uncontrolled storage, and use of unauthorized operator’s aids. 

During the review the team has found the following. 

Not reported deficiencies in the field: 

- HPSI pump, two I&C cables at TJ041V002 box are repaired with insulation 
tape; 

- Room 02.118, Fire protection barrier in HPSI pump’s room is displaced from 
its original position, fixed in a new place with only 50% of bolts as per design; 

- Several plastic protection rings on cable’s guide tubes in HPSI and LPSI pump 
compartments (e.g. TJ023D001) - found broken, fragmented, displaced. None of the 
above mentioned deficiencies on safety Systems were identilïed during operator rounds. 

Uncontrolled temporary storage areas: 

- In room 05.225, a spare 6kV switch is stored in an unlabelled / unmarked 
place, not fixed to prevent inadvertent movement; 

- In room 05.224, three spare 6kV switches are stored in an unlabelled / 
unmarked place, not fixed to prevent inadvertent movement; 

- In room 05.227, 4 movable tables with test equipment are stored in a 
undesignated area, preventing access to electric cabinets of safety system; 

- In room 72.301, temporary storage of Instruments, personal belongings in a 
undesignated area; 

- Unauthorized storage of materials in room 02/301; 

- On the scaffolding Nb. 151329, erected in 25.8.2014- a several scaffold parts 
were stored on the bottom platform; 

- In turbine building at Elevation 0 m., scaffolding parts are stored in an 
unlabelled place, parts are mixed with other metal pipes. 

Unauthorized operator’s aids: 

- More than 10 uncontrolled copies of technological schemes, diagrams, 
procedures found fixed to the wall in the Field Reactor Operator’s room 03/408; 

- Room 10.202, Safety diesel EY030D001: Unauthorized technological scheme 
on cabinet DK/ UW80-81; 

- Room 72.203: Unauthorized copy of a diagram; 

- Entrance to 02.125 room (TA032D001) - copy of uncontrolled drawing fixed 
to the wall; 

- Room 10.201: Unauthorized operator’s aids on electric cabinet US040H001; 
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Entrance to 02.125 room (TA032D001) - copy of uncontrolled drawing fixed 

to the wall. 
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Failure to detect and/or report minor equipment defects, accumulation of uncontrolled or 
unmanaged storage places, and use of uncontrolled documentation could lead to random 
unavailability of equipment and operator errors that may affect the safety of the plant. 

Suggestion: The plant should consider developing and implementing a robust program to 
improve operational practices, such as detecting and reporting minor events, eliminate 
unmanaged storage places and use of operational aids. 

lAEA Bases: 

SSR-2/2 

7.4. Operating procedures and supporting documentation shall be issued under controlled 
conditions, and shall be subject to approval and periodically reviewed and revised as 
necessary to ensure their adequacy and effectiveness. Procedures shall be updated in a timely 
manner in the light of operating experience and the actual plant configuration. 

7.5. A System shall be established to administer and control an effective operator aids 
programme. The control System for operator aids shall prevent the use of non-authorized 
operator aids and any other non-authorized materials such as instructions or labels of any 
kind on the equipment, local panels, boards and measurement devices within the work areas. 
The control System for operator aids shall be used to ensure that operator aids contain correct 
information and that they are updated periodically reviewed and approved. 

7.6. A clear operating policy shall be maintained to minimize the use of, and reliance on, 
temporary operator aids. Where appropriate, temporary operator aids shall be made into 
permanent plant features or shall be incorporated into plant procedures. 

7.10. Administrative Controls shall be established to ensure that operational premises and 
equipment are maintained, well lit and accessible, and that temporary storage is controlled 
and limited. Equipment that is degraded (owing to leaks, corrosion spots, loose parts or 
damaged thermal insulation, for example) shall be identified, reported and corrected in a 
timely manner. 


NS-G-2.14 


4.35. Personnel assigned the task of carrying out rounds should be made responsible for 
verifying that operating equipment and standby equipment operate within normal parameters. 
They should take note of equipment that is deteriorating and of factors affecting 
environmental conditions, such as water and oil leaks, bumed out light bulbs and changes in 
building temperature or the cleanness of the air. Any problems noted with equipment should 
be promptly communicated to the control room personnel and corrective action should be 
initiated. 

4.36. Factors that should typically be noted by shift personnel include: 

- Deterioration in material conditions of any kind, corrosion, leakage from 
components, accumulation of boric acid, excessive vibration, unfamiliar noise, inadequate 
labelling, foreign bodies and delïciencies necessitating maintenance or other action; 

- Indications of deviations from good housekeeping, for example the condition 
of components, sumps, thermal insulation and painting, obstructions, posting of signs and 
directions in rooms, posting of routes and lighting, and posting and status of doors; 
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Deviations in lïre protection, such as deterioration in fire protection Systems 
and the status of fire doors, aeeumulations of materials posing fire hazards such as wood, 
paper or refuse and oil leakages, or industrial safety problems such as leakages of fire 
resistant hydraulic fluid, hazardous equipment and trip hazards; 

Deviations in other installed safety protection devices, such as fiooding 
protection, seismic constraints and unsecured components that might he inadvertently 
moved. 
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3.5. WORKAUTHORIZATIONS 


3.5(1) Issue: The plant’s expectations and work management process are not robust enough 
to ensure effective personnel resource usage, completion of risk reviewed work, and safe 
work Schedule stability. 

During the review team has identified the following: 

- Meetings during the formal work management process are not consistently 
attended by all departments, in some observed cases personnel at the meetings did not 
have the required knowledge or decision making authority; 

- Challenges to the work management process are not resolved in the site’s 
corrective action program, leading to recurrences of past problems, and poor performance 
in completing risk reviewed and scheduled work. This was observed during work order 
14856 when personnel propped open a fire door which caused a loss of train separation 
between class battery rooms. Plant maintenance personnel stated that this had happened 
before; 

- Six planning and preparation steps in the site work management procedure 
(11, 25, 30, 43, 49, and 58) are being performed after the T-5 week. Not performing 
planning and preparation steps before T-5 results in less time to review work documents, 
perform job site walk downs, and to write clearances; 

- KPTs for the 12 week process are not being used effectively to measure and 
detail the plant’s performance in execution of the work management process. The root 
causes of poor performance and needed improvement areas are not fully identified 
currently. 

Without consistent adherence to the work management process, and implementation of the 
safe work Schedule in the field, the plant may be put into unsafe conditions. 

Recommendation: The plant should reinforce its expectations, and improve the work 
management process, to ensure that personnel resources are used more effectively improve 
Schedule stability, and complete the risk reviewed work plan more consistently. 

lAEA Bases: 

SSR-2/2 

8.8. A comprehensive work planning and control System shall be implemented to ensure that 
work for purposes of maintenance, testing, surveillance and inspection is properly authorized, 
is carried out safely and is documented in accordance with established procedures. 

NS-G-2-14; 

7.4. The work control process should ensure adequate interfaces between all work groups. 
Operations personnel should assist the maintenance department in the planning and execution 
of work on plant Systems and components to ensure that the reliability and availability of 
equipment are optimized. 

7.10. Planning of work on plant Systems and equipment important to safety should be well 
coordinated to ensure that the plant remains in a safe condition at all times and in accordance 
with the operational limits and conditions. 
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7.11. Sufficiënt resources should be provided for operations to guide and assist in the 
planning and scheduling of major work sequences. The operations management should be 
actively involved in the process of planning and scheduling work. Additional support should 
be provided to operations staff for outages and other periods of high workload. 

7.9. Efforts should be made to minimize the number of extended work orders. The causes of 
deviations from the planned Schedule should be subject to a thorough analysis to identify any 
necessary amendments to the System covering the planning and performance of work. 

NS-G-2.6 

5.36. The review programme should examine the MS&I programme for features such as: 

- Adequacy of the Schedule and its implementation. 
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3.6. FIRE PREVENTION AND PROTECTION PROGRAMME 


3.6(1) Issue: The plant’s fire protection and prevention program, and implementation of the 
program elements related to authorization of opening fire doors, personnel hehaviours, and 
storage of eomhustihle materials are not effeetive. 

During the review the team has identified the following: 

- In support of work order 14856, fire door 05.308 was authorized to he propped 
open by fire brigade personnel, and this resulted in the loss of train separation between 
the two safety class batteries and a reduetion in ventilation effeetiveness; 

- The Operations Shift Team Leader was not part of the authorization proeess 
for determining if a door should have been propped open as direeted by plant procedure 
A09-26-N022, and the site has no formal program for controlling doors and batches; 

- Plant personnel do not routinely verify that fire doors have closed and latched 
after they transit through the doors; 

- Temporary shielding is not evaluated for fire loading impact prior to being 
installed in areas of the plant containing safety equipment; 

- The aggregate impact of all fire protection system open deficiencies is not 
being evaluated to ensure fire protection system response will be adequate to meet 
potential fires on site. 

Without improvements to the site’s fire protection program, plant events may be worsened by 
spreading fires due to open fire doors and unintended ventilation fiow paths, both of which 
could jeopardize safety system equipment. 

Recommendation: The plant should enhance the fire protection program, to ensure that 
personnel hehaviours are improved, fire door authorizations are more robust, and safety 
system integrity is not compromised. 

lAEA Bases: 

SSR-2/2 

5.21. The arrangements for ensuring fire safety made by the operating organisation shall 
cover preventing the spread of those fires that have not been extinguished; and providing 
protection from fire for structures, Systems and components that are necessary to shut down 
the plant safely. 


NS-G-2.1 


2.9. Plant personnel engaging in activities relating to fire safety should be appropriately 
qualified and trained so as to have a clear understanding of their specific areas of 
responsibility and how these may interface with the responsibilities of other individuals, and 
an appreciation of the potential consequences of errors. 

3.1. The operating organisation should establish a comprehensive program for fire prevention 
and protection to ensure that measures for all aspects of fire safety are identified, 
implemented, surveyed and documented throughout the entire lifetime of the plant. 
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6.1. Administrative procedures should be established and implemented for effective control of 
eombustible materials throughout the plant. 

7.3. Minimum acceptable levels of availability should he estahlished and documented for all 
lire proteetion features identified as important to safety. Interim compensatory measures 
should he defined for eaeh fire proteetion feature identified in this way. 
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4. 


MAINTENANCE 


4.1. ORGANISATION AND FUNCTIONS 

The maintenance organisation structure and functions are elearly defïned at the plant. 
Maintenanee leaders ensure that work order development and reviews by well-trained 
department personnel are being performed. The team also noted that personnel eapacities and 
work loading are not always balanced, leading to less than optimum use of resourees. 
Maintenanee staff training ensures that qualified personnel are available to perform all 
seheduled work, hut a formal training certificate for completion of training does not exist. 
The team encourages the plant to develop a method to traek staffing availability so that 
enough work can be seheduled to reduce existing baeklog of work orders. 

4.2. MAINTENANCE FACILITIES AND EQUIPMENT 

The plant has developed some equipment to be used during outages that results in lower 
doses reeeived by workers. The plant has introduced a specifie manipulator to perform 
ultrasonie testing of eontrol rod drive tube weids on the reaetor vessel head. The team 
identified this as a good praetiee. 

4.3. MAINTENANCE PROGRAMMES 

The plant use of KPTs for the maintenance organisation is only marginally effective due to 
not tracking key areas such as rework and not accurately reflecting the status of maintenance 
backlogs. The present support activities such as other maintenance in the preventive 
maintenance baeklog are currently increasing. The team encourages the plant to perform 
analysis and categorization of the preventive maintenance baeklog and the rework statistics in 
order to establish an action plan for the reduction of both. 

4.4. PROCEDURES, RECORDS AND HISTORIES 

The plant writes high quality work packages for complex jobs, but does not apply the tooi 
pouch approach for minor maintenance activities, resulting in limited planning resources 
being used inefficiently. The plant does not effectively use technician feedback provided to 
improve work packages when work is completed, as there is no formal method for this 
feedback to be used and for resulting actions to be captured (for example changing spares 
requirements or procedure steps or further corrective maintenance requirements). The team 
encourages the plant to implement a work package process using a graded approach to work 
preparation, and develop a process to formalize and use feedback from technicians to 
improve the work packages and future planning. 

4.5. CONDUCT OF MAINTENANCE WORK 

The plant has a procedure and program for FME, work packages identify EME risks, and 
FME is covered in PJB prior to work performance. However there are some examples when 
high standards of FME requirements were not fully met. These examples indicate that overall 
principles and possible consequences are not fully understood by staff and implemented in 
praetiee. The team has made a recommendation for improvement in this area. 

The team observed work in progress in the field, and on some occasions, parts and materials 
associated with the work package were not properly controlled, and the working area was not 
well marked to keep other workers out of the area. The team encourages the plant to reinforce 
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expectations regarding control of material and work areas to protect employees and plant 
equipment. 

4.6. MATERIAL CONDITIONS 


The team performed observations and noted that the plant material condition supports safe 
operations. Standards and requirements related to material conditions are established in 
proeedures, which also state how to maintain the plant and how to register and label leaks. In 
some cases, the team noted that high standards for material conditions were not always 
maintained, and examples include leaks, material corrosion, small deficiencies on equipment, 
and practices related to poor material selection. The team has made a suggestion in this area. 
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DETAILED MAINTENANCE FINDINGS 


4.2. MAINTENANCE FACIEITIES AND EQUIPMENT 

4.2(a) Good Practice: Manipulator used for ultrasonic testing of reactor control rod drive 
tubes. 

The plant has introduced and developed a specifïc manipulator for the ultrasonic test of 
several weids located on reactor head control rod drive tubes. 

More inspections are required on the reactor control rod drive tubes, due to the latest version 
of the ASME code and the enhanced requirements of the ageing management program. An 
assessment of the material properties and behaviours has been made for all reactor control 
rods tube weids with and without the thermal sleeve with the new ultrasonic inspection tooi, 
to ensure that the mechanisms and changes in material properties are known and there are no 
intemal changes or degradation on the inside of the tubes. 

The lower weids of the reactor vessel tubes are located under the thermal insulation and can 
only normally be reached by removing the insulation. This would give high radiation 
exposures and so weids were not inspected. Previously, the upper weids have been inspected 
several times with radiographic and penetrant method. 

With the use of this new manipulator, ultrasonic inspections can be carried out for lower 
weids, as the manipulator is placed below the head and the probes can reach all weids on all 
the tubes. The manipulator includes two manipulators reaching both required diameters of 
147.2 mm and 55 mm. 

The inspection method was fully qualifïed using blind and open calibration blocks on basis of 
European Network for Inspection Qualification (ENIQ) requirements. 

Using this new inspection manipulator the inspection time and radiation exposures received 
are significantly reduced. 
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4.5. CONDUCT OF MAINTENANCE WORK 


4.5(1) Issue: Foreign material exclusion (FME) principles are not fully understood and a 

comprehensive FME program is not implemented. 

The team made the following observations: 

- One seetion of safety barrier around the fuel pool at 24m elevation of reaetor 
building was missing. Ineomplete barriers can allow items to be kicked or to roll into the 
pool; 

- On the refuelling machine, at the 24m level of the reactor building, there are 
three folders with procedures. This results in loose paper stored above the pond which 
could fall in; 

- A sensitive pressure measurement device (perskar) and its tools, nozzles and 
hose ends were not covered or plugged; 

- A flange on UE02S012 and UE01S019 in the Turbine hall was found open and 
not protected against ingress of foreign material; 

- Some components in the central warehouse and maintenance “kippenkot” 
have no FME protection caps; 

- A four foot seetion of piping on the floor in the demineralization plant was 
found on the floor in the corner of the room and a flange of the pipe was not covered; 

- Plant personnel do not always remove their equipment from working areas 
when work is interrupted or fmished. This was observed in many rooms (including the 
diesel generator room). This loose equipment and tools left without appropriate Controls 
has the potential to cause or contribute to FME events; 

- FME training (Z3-EW electronic leaming) is available hut not used by plant 
staff and there is no specific authorisation for EME practices for workers. 


Without effective FME program implementation and tracking, the plant is not mitigating 
foreign material risks which can impact safe and reliable plant operation. 

Recommendation: The plant should ensure that EME principles are understood and a 
comprehensive FME program is implemented. 

lAEA Bases: 


SSR 2/2: 


7.11. An exclusion programme for foreign objects shall be implemented and monitored, and 
suitable arrangements shall be made for locking, tagging or otherwise securing isolation 
points for Systems or components to ensure safety. 


NS-G-2.5: 
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3.9. The areas for the handling and storage of fresh fuel should be maintained under 
appropriate environmental conditions (in respeet of humidity, temperature and elean air) and 
eontrolled at all times to exclude ehemieal eontaminants and foreign materials. 


3.19. Inspeetions should neither damage the fuel nor introduee any foreign material into it. 
Inspeetors should identify any foreign material already present in the fuel and should remove 
it. 
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4.6. MATERIAL CONDITION 


4.6(1) Issue: High standards of material condition in some plant areas are not consistently 

maintained. 

The team made the following observations: 

- EYOlO, 20, 30; there is oil aeeumulation under the diesel generators, left over 
from the last diesel yearly maintenanee; 

- AU of the Turbine Bypass Steam Dump Valves have oil leaks, and some of the 
valves have multiple oil leaks; 

- Three leaks were identifïed in the HP injeetion pump rooms (TJ44D001 - 
outer Seal leak, TJ80S009 - leakage at drain valve plug onto floor and TJ43S020 - leakage 
at drain valve plug onto floor); 

- In room 04/210, the safety water eooling system (VF), there is leakage on a 
valve flange and a pump; 

- Some eables are not properly and safely terminated (one eleetrieal eable not 
insulated lying on the eover of the generator and another at the hydroehlorie aeid tank 
building); 

- Corrosion on eomponents in the NaOH and HCL dosing pump area in room 
09.102; 

- A leak on a pipe (UA045Z001) in the Demineralization Station; 

- The blind flange (RS021G003) was mounted together to the pipe stainless 
steel flange with very eorroded earbon steel bolts and nuts; 

- There were bolts missing on the eabinet covers of the eleetrieal cabinets 
ER020, MD072X400 and MD072Y400 in room 72.104; 

- Several examples were found where equipment or small pipe was not correctly 
fixed by supports (SZ20S070 in the turbine hall, pipe in the room 03/125); 

- Several examples were found where stainless steel material was not correctly 
stored and maintained against degradation. 

Degraded material conditions could lead to deterioration of safety system availability and 

reliability. 

Suggestion: The plant should consider consistently maintaining high standards of material 

condition. 

lAEA Bases: 

SSR -2/2 


Requirement 28: 

The operating organisation shall develop and implement programmes to maintain a high 
Standard of material conditions, housekeeping and cleanliness in all working areas. 
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7.10. Administrative Controls shall be established to ensure that operational premises and 
equipment are maintained, well lit and accessible, and that temporary storage is controlled and 
limited. Equipment that is degraded (owing to leaks, corrosion spots, loose parts or damaged 
thermal insulation, for example) shall be identilïed, reported and corrected in a timely marmer. 


NS-G-2.6 

10.17. A visual examination should be made to yield Information on the general condition of 
the part, component or surface to be examined, including such conditions as the presence of 
scratches, wear, cracks, corrosion or erosion on the surface, or evidence of leaking. Any visual 
examination that requires a clean surface or decontamination for the proper interpretation of 
results should be preceded by appropriate cleaning processes. 


NS-G-2.14 


4.36. Factors that should typically be noted by shift personnel include: 

- Deterioration in material conditions of any kind, corrosion, leakage from 
components; 

- Accumulation of boric acid, excessive vibration, unfamiliar noise, inadequate 
labelling; 

- Foreign bodies and deficiencies necessitating maintenance or other action. 
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5. 


TECHNICAL SUPPORT 


5.6 ORGANISATION AND FUNCTIONS 

The team found that there are only 3 performance indicators in use within the Technical 
Support department. There are no performance indicators on the number of open 
modifications, or the length of time between implementing a modification and updating all 
documentation. The team encourages the plant to review where performance indicators may 
be beneficial to maintaining a strong focus. 


The team found that there is no directed reading programme in place in either the Technical 
Support department or the Monitoring department. Therefore the team encourages the plant 
to implement a directed reading programme to ensure that workers are made aware of new 
or revised procedures. 

5.7 PERIODIC SAFETY REVIEW 


The recent Periodic Safety Review (PSR) (10EVA13) performed a thorough evaluation of 
safety Systems and procedures against multiple international standards and guidelines, 
beyond what was required by national regulations. Additionally the review considered 
current state of the art technology and methods, and lessons leamed from previous PSRs. 
The team considers this to be a good performance. 

5.8 PROGRAMME FOR EONG TERM OPERATION 


The plant’s Tong Term Operation programme made a thorough assessment of all 
components and the associated ageing mechanisms. The use of feedback from a SAETO 
review, and the assessment of active components provided good performance in this area. 

5.9 SURVEIEEANCE PROGRAMME 


The team observed that the lack of coordination of ownership and reporting for Systems, 
structures, and components (SSC), is leading to an incomplete overview of the status of 
SSCs. Operations have ownership of the testing of SSCs, Maintenance have ownership of 
maintaining SSCs, and Engineering have ownership of in-service inspections, however these 
groups do not review each other’s reports. Additionally the trending and analyses of the 
results of maintenance, surveillance, and testing activities is inadequate, and reporting is 
only done on failures. This means that the opportunity to perform maintenance on 
deteriorating equipment before it fails could be missed. The team has made a suggestion in 
this area. 

5.10 PEANT MODIEICATION SYSTEM 

The team observed that the process for temporary modifications is not providing the 
necessary assessments or Controls. There is no categorisation system for temporary 
modifications to allow for a graded approach to safety, and the initial safety assessment is 
not performed according to an established procedure. There is no expectation on the number 
or time limit for temporary modifications, and there are inconstancies in the temporary 
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modifications database. This could lead to unapproved modifications on safety related SSCs. 
Additionally the labelling of temporary modifieations was inadequate. The team has made a 
reeommendation in this area. 

The plant employs the Portfolio Management System in order to assess the risks associated 
with each proposed modifïeation and assist in their prioritisation. The System also aides in 
the management of resources, and shows the availability of key resources to perform each 
stage of the modifïeation. This allows for the allocation of funds and resources to the 
modifications which are either of the highest urgency or which will provide the most value. 
The team considers this to be a good performance. 

It was observed by the team that the level of knowledge of the modification system of some 
staff who are indirectly involved in plant modifications was lacking. The team therefore 
encourages the plant to increase the non-expert stafPs level of knowledge and awareness of 
the modifications system requirements and procedures. 


The team observed that there are some shortfalls in the plant’s programme for the control 
and modification of computer based Systems. It was observed that small changes to the 
Process Presentation System (PPS) were being performed out with the modifications 
Systems and that some of these small changes do not undergo verification. Also there is not 
a disaster recovery procedure for the restoration of a backup. It was found that whilst error 
logs were kept for the PPS these error logs did not typically undergo annual review in order 
to assess trends or reoccurring faults or errors. There is no offline version of the PPS on site 
to allow for testing of changes before they are applied to the main system, and access to the 
engineering terminal for the PPS was not adequately controlled. Therefore the team 
encourages the plant to improve its programme for the control and modification of computer 
based Systems. 

5.11 REACTOR CORE MANAGEMENT (REACTOR ENGINEERING) 

The plant has no capability for core modelling. This limits the on-going assessment of core 
parameters which can be performed throughout a cycle. Additionally the plant has no 
facility to model a Xenon transient based on the actual reactor power history and conditions. 
The team encourages the plant to implement a core modelling and transient modelling 
system. 

The plant currently has no route for the dispatch of failed fuel to a hot cell facility. This does 
not allow for the post irradiation examination of failed fuel, to establish of the cause of the 
fuel failure. The team encourages the plant to implement a route for the dispatch of failed 
fuel, so that root cause analyses can be performed on fuel failures. 
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DETAILED TECHNICAL SUPPORT EINDINGS 


5.4. SURVEILLANCE PROGRAMME 

5.4(1) Issue: The plant does not have a program whieh provides an adequate analysis of the 

results of Maintenanee, Surveillance and Inspection (MS&I) activities. 

The following ohservations were made: 

- System ownership is fragmented between Maintenanee and Operations, with 
input from Engineering; 

- MS&I reports are not produced, and reporting is extremely fragmented. 
There is no integrated assessment of System MS&I providing a system overview; 

- The owners of one aspect of a system don’t read the reports of the owners of 
other aspects; 

- Operations have developed a list detailing what aspects of each system 
should be prioritized hut it is not distributed to Maintenanee or Engineering; 

- Battery voltage test results were not trended for use in preventative 
maintenanee; 

- An Operations Technician believed that the diligence of trending of test 
results varied over shifts; 

- Operations system owners are only required to check test results against an 
acceptance criteria and previous result - no trending over time; 

- There is no formal procedure for the trending of in-service inspection results 
(again results are compared to an acceptance criteria and previous results and not 
trended over time); 

- System reports are reported by exception. They only focus on things that 
went wrong and don’t review other areas to identify issues before they develop (reactive 
not proactive); 

- Plant walk downs are performed on a type of component basis e.g. to look at 
pipe hangers, hut there are no walk downs to look at individual Systems; 

- There is no formal process to assess equipment availability; it is performed as 
a set of separate functions whieh are not integrated. 

Without an adequate analysis of MS&I activities the ability to assess adverse trends is 

compromised whieh could lead to the failure of safety related Systems. 

Suggestion: The plant should consider implementing a programme to provide a 

comprehensive assessment on the results of MS&I activities. 

lAEA Bases: 
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SSR-2/2 


8.1. Maintenance, testing surveillance and inspection programmes shall be established that 
include predictive, preventative and corrective maintenance activities. These maintenance 
activities shall be conducted to maintain availability during the service life of structures, 
Systems and components by controlling degradation and preventing failures. 

8.11. Coordination shall be maintained between maintenance groups and operations groups 
and support groups. 


NS-G-2.6 


4.12 The plant management should estahlish a group on the site to implement the MS&l 
programme. 

5.24 Effective co-ordination should be established: 

- Among different maintenance groups (mechanical, electrical, instrumentation 
and control, and civil engineering maintenance groups); 

- Among the operations, radiological protection and MS&l groups; (c) Among 
the plant departments and contractors. 

6.10. The results should be examined, where appropriate, for trends that may indicate the 
deterioration of equipment. 

6.11. Histories of past MS&l should he used for supporting relevant activities, upgrading 
programmes, and optimizing the performance and improving the reliahility of equipment. 

6.12. Historical records of MS&l should be periodically reviewed and analysed in order to 
identify any adverse trends in the performance of equipment or persistent problems, to 
assess impacts on system reliahility and to determine root causes. 
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5.6. PLANT MODIFICAHON SYSTEM 


5.6(1) Issue: The process for handling of temporary modifications does not provide 

adequate arrangements for their review, approval or control, to ensure that temporary 

modifications do not adversely affect safety. 

The following observations were made: 

- There is no categorisation system for temporary modifications; 

- There is no plant limit or expectation on the number of temporary 
modifications; 

- The review of temporary modifications by Technical Support is at their 
discretion, and no process exists to alert Technical Support to new temporary 
modifications before implementation; 

- There are inconsistencies in the temporary modifications database; 

- There is no limit on the number of extensions a temporary modification can 
receive; 


- The Operations Manager decides whether a temporary modification is 
extended with no further technical review; 

- The Technical Support department is not on the review list for any procedure 
change regarding temporary modifications; 

- Maintenance technicians are the typical initiators of temporary modifications 
and a maintenance technician had never read the procedure for temporary modifications, 
and there has never been any training or directed reading on the procedure; 

- Some temporary modification labels were not filled out correctly; 

- A temporary modification was in the database but there was insufficiënt 
information to find the temporary modification on the plant. 

Without an adequate process for the review, approval, and control of temporary 
modifications a modification could be implemented with an unintended negative effect on 
nuclear safety. 

Recommendation: The plant should implement a process which provides for adequate 
review, approval, and control of temporary modifications, to ensure that temporary 
modifications are handled in a safe marmer. 

lAEA Bases: 

SSR-2/2 

4.39. A modification programme shall be established and implemented to ensure that all 
modifications are properly identified, specified, screened, designed, evaluated, authorized, 
implemented and recorded. 
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4.40. Modification control shall ensure the proper design, safety assessment and review, 
eontrol, implementation and testing of all permanent and temporary modifieations. 

4.41. Temporary modifieations shall he limited in time and number to minimize the 
eumulative safety signifieanee. 


NS-G-2.3 


6.3. The number of temporary modifieations should be kept to a minimum. A time limit 
should be speeified for their removal or conversion into permanent modifieations. 

6.4. The procedure for obtaining approval to implement a temporary modification should be 
the same as that for a permanent modification. In the procedure for authorization of 
proposed temporary modifieations, it should be ensured that they do not result in an 
unreview safety issue. In the review of proposed temporary modifieations and planned 
permanent modifieations, any existing temporary modifieations and the effects of the 
proposed change should also be considered. 

6.7. The process for temporary modifieations should allow for rapid review and assessment 
of any proposed modifieations that have to be undertaken urgently. Such urgent actions, 
however, should neither reduce levels of safety nor bypass the obtaining of regulatory 
approval as necessary. 

6.9. An appropriate procedure should be established to control temporary modifieations on 
the plant. The following areas should be covered in this procedure: 

- Requirements for technical reviews, in particular safety reviews to be 
performed before temporary modifieations are made. Temporary modifieations to 
structures, Systems and components and process software important to safety should be 
independently reviewed by personnel not involved in the design or implementation of 
the temporary modification and should be submitted for regulatory approval, as 
required, before implementation; 

- Control of documentation, to ensure that all documentation — such as 
operating flow sheets, operating manuals, maintenance manuals, emergency procedures 
— refiects temporary modifieations, to ensure that the plant continues to be operated and 
maintained safely while the modification is in place. 
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6 . 


OPERATING EXPERIENCE FEEDBACK 


6.1. ORGANISAHON AND FUNCTIONS 

The plant’s operating experience (OE) program is not effectively identifying corrective 
actions needed to improve performance in a timely manner. Contributing to this 
performance are gaps in identifying the types of reviews required for some events, a 
database System that is used for trending hut does not track issue owners, actions to be 
taken, or due dates. The team recommends that the plant should enhance its expectations 
and provisions in the area of OE feedback to ensure that in-house and extemal OE are 
utilized comprehensively, in a timely and effective marmer. 

6.5. INVESTIGATION AND ANALYSIS 

The team found that analysis of some events did not always ensure that root causes are 
identified and consistently corrected in a timely manner. The plant procedure goveming 
this process does not contain all needed requirements to ensure the appropriate reviews are 
completed. This performance gap has resulted in repeat events. The team recommends that 
the plant improves the quality, timeliness, and causal analysis of events. 
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DETAILED OPERATING EXPERIENCE EINDINGS 


6.1. ORGANISAHON AND FUNCTIONS 

6.1(1) Issue: The plant expectations and provisions in the area of operating experience 

feedhaek do not ensure that in-house and extemal operating experienee (OE) is utilized 

eomprehensively, in a timely and effeetive marnier. 

- The plant safety poliey laeks a statement devoted to utilization of in-house 
and extemal OE; 

- The plant does not have a formal OE program; 

- Qualifieation eriteria and training requirements for the personnel reviewing 
OE are not established at the plant; 

- OE procedures do not always include defmitions, references to international 
standards or other plant procedures, or responsihilities of OE personnel and managers; 

- Definitions and criteria for low-level events and near misses are not specified 
at the plant. 

- The plant uses separate data hases for intemal events, extemal events, Eow 
Eevel Events (EEE), and Near Missess (NM), making it difficult to identify common 
issues. 


- The plant’s “Class Base” database does not track the person responsible for 
lessons leamed associated actions, feedback, and final status of NM and EEE; 

- The plant last performed a QA audit for the OE program in 2010/2011; 

- There are nine total extemal events in the OE backlog from 2007, 2011, 
2013, and 2014, including 1 WANO SOER, several SERs and other events. These events 
have not been reviewed to identify if actions are required at the plant. 

Without a robust OE programme, the plant may miss opportunities to learn from in-house 
and extemal experience, which could result in diminished plant safety. 

Recommendation: The plant should enhance its expectations and provisions in the area of 
OE feedback to ensure that in-house and extemal OE are utilized eomprehensively, in a 
timely and effeetive mannen 

lAEA Bases: 

SSR-2-2 

5.33. The operating experience programme shall be periodically evaluated to determine its 
effectiveness and to identify any necessary improvements. 


NS-G-2.11 

2.9. There should be a commitment from the management in the various participating 
organisations involved in the national operational experience feedback programme to ensure 
that it is efficiënt and effeetive. 
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2.12. Adetailed procedure should be developed by the operating organisation on the basis of 
the requirements for a national system established by the regulatory body. This procedure 
should define the proeess for dealing with all intemal and extemal information on events at 
nuelear installations. The proeedure should preeisely define the strueture of the system for 
the feedback of operational experience, the types of information, the ehannels of 
eommunication, the responsibilities of the groups and organisations involved, and the 
purpose of the doeumentation produeed. Organisations that have various roles within the 
national proeess for the feedbaek of operational experienee usually inelude operating 
organisations, the regulatory body, plant designers and researeh organisations. The 
procedure should be made available for review or approval by the regulatory body, if so 
required. 

10.12. Reports in the system for the feedbaek of operational experienee should be stored in 
sueh a marmer that the information they eontain can be easily sorted and retrieved by both 
the operating organisation of the nuelear installation and the regulatory body, as appropriate. 
The information should be organized to facilitate frequently needed searehes for, for 
example: 

- Events at similar units; 

- Systems or eomponents that failed or that were affected; 

- Identifieation of the eauses of events; 

- Identifieation of lessons learned; 

- Identifieation of trends or pattems; 

- Events with similar eonsequenees for personnel or for the environment; 

- Identifieation of failure types or human faetor issues; 

- Identifieation of reeovery aetions and eorreetive aetions. 

NS-G-2.4 

6.67. The responsibilities, qualifieation eriteria and training requirements of personnel 
performing aetivities to review operating experienee should be elearly defmed. Personnel 
who eonduet investigations of abnormal events should be provided with training in 
investigative root cause analysis teehniques sueh as aceident investigation, human faetor 
analysis (ineluding organisational faetors), management oversight and risk tree analysis, 
ehange analysis and barrier analysis. Event investigators should be... 

6.64. The operating experienee at the plant should be evaluated in a systematie way, 
primarily to make eertain that no safety relevant event goes undeteeted. Eow level events 
and near misses should be reported and reviewed thoroughly as potential preeursors to 
degraded safety performanee. Abnormal events important to safety should be investigated in 
depth to establish their direet and root eauses. Methods of human performanee analysis 
should be used to investigate human performanee related events. The investigation should 
result in elear reeommendations to plant management, whieh should take appropriate 
eorreetive aetion without undue delay to prevent reeurrence. 
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6.5. INVESTIGATION AND ANALYSIS 


6.5(1) Issue: Analysis of some events did not always ensure that the root cause is identified 

and are not consistently eorreeted in a timely marmer. 

- Authorized procedures, containing instructions and guidelines, for performing 
a full root cause analysis (RCA), an apparent cause analysis (ACA), and a trend analysis 
do not exist; 

- The plant has a large long standing hacklog of analyses of internal and 
extemal events. The hacklog of unlïnished analyses decreased from 77 in 2011 to 68 in 
2013, and 50 in 2014; 

- A procedure for performing RCA and ACA exist in a draft version at the 
plant; 

- The plant has a hacklog of category 3 and 4 reviews, which require ACA, that 
have not been completed within the three month plant target. The unfinished analyses 
include 3 from 2012, 10 from 2013, and 28 from 2014; 

- Plant procedure PU-NOl-07, “Analysing Internal and Extemal Events”, does 
not consider all the necessary factors or criteria to determine the correct type of 
investigation to perform; 

- The plant has experienced a large number of repeat events, including 18 in 
2011, 17 in 2012, 25 in 2013, and 6 events as of September 2014. This indicates that OE 
reviews are not resulting in lesson learned to prevent recurrence of events; 

- The plant is not performing the required number of RCA due to missing 
requirements in the plant procedure for classifying the level of review that is needed. 
Examples include repeat plant events, complex plant events, and INES category 1 events; 

- Between 2009 and 2011 no plant events were analysed with RCA, although 3 
events were classified as meeting the INES 1 criteria; 

- Analyses performed between 2009 and 2012 were not performed in a 
systematic manner, and the documentation for these reviews cannot be extracted from the 
plant database; 

Plant KPI’s indicate poor performance in the following areas: 

- Approval of recommended actions from the OE department by the responsible 
departments. The target for satisfactory performance is 20 days, hut the site average 
performance is 50 days for 2014; 

- Time from receipt of OE to when recommended actions are submitted for 
approval. The target for satisfactory performance is 150 days, hut the average for 2013 
was 239 days, and 312 days for 2014. 

Without timely and adequate reviews and analysis of OE, the potential exists for repeating 

plant events or having events that challenge plant safety. 

Recommendation: The plant should improve the quality, timeliness, and causal analysis of 

events. 
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lAEA Bases: 


SSR-2-2 

5.28. Events with safety implications shall be investigated in accordance with their actual or 
potential significance. Events with significant implications for safety shall be investigated to 
identify their direct and root causes, including causes relating to equipment design, operation 
and maintenance, or to human and organisational factors. The results of such analyses shall 
be included, as appropriate, in relevant training programmes and shall be used in reviewing 
procedures and instructions. Plant event reports and non-radiation-related accident reports 
shall identify tasks for which inadequate training may be contributing to equipment damage, 
excessive unavailability of equipment, the need for unscheduled maintenance work, the need 
for repetition of work, unsafe practices or lack of adherence to approved procedures. 

NS-G-2.4 

6.64. The operating experience at the plant should be evaluated in a systematic way, primarily 
to make certain that no safety relevant event goes undetected. Eow level events and near 
misses should be reported and reviewed thoroughly as potential precursors to degraded safety 
performance. Abnormal events important to safety should be investigated in depth to 
establish their direct and root causes. Methods of human performance analysis should be used 
to investigate human performance related events. The investigation should result in clear 
recommendations to plant management, which should take appropriate corrective action 
without undue delay to prevent recurrence. 


NS-G-2.11 

4.2. Accordingly, the operating organisation or licensee, as appropriate, should have 
procedures in place specifying the type of investigation that is appropriate for an event of 
any particular type. Such procedures typically outline the conduct of an investigation in 
terms of means of initiation, duration, composition of the investigation team, terms of 
reference for the investigation team and format of the fmal report. A typical outline of an 
investigation process is given in Appendix III. 

4.3. The level of the investigation carried out should be commensurate with the consequences 
of an event and the frequency of recurring events. Significant factors that would influence the 
magnitude of an investigation may include the following: 

- The consequences of the event and the extent of damage to Systems, structures 
and components; 

- Any injury to on-site persormel; 

- Whether a similar occurrence has taken place earlier at the same installation or 
at an installation of a similar type; 

- Whether a significant radiological release or an overexposure of personnel has 
occurred; 

- Whether plant operation exceeded the operational limits and conditions or was 
beyond the design basis of the plant; 

- Whether there is a pattem that is complex, unique or not well enough 
understood. 


OPERATING EXPERIENCE FEEDBACK 


51 



4.4. The scope of investigations of events should vary appropriately: 

- In the case of a single serious event there should be a Panel or a Board of 
Inquiry chaired by a senior officer, involving many people and making extensive use of 
root cause analysis techniques; 

- For an event with no consequences or a minor event, or for adverse trends, a 
relatively quick and simple investigation should be conducted by an individual trained in 
event investigation techniques; this latter type of investigation may result in the 
identification of an apparent cause only (rather than a true root cause). 

4.10. The analysis of any event should be performed by an appropriate method. 

It is common practice that organisations regularly involved in the evaluation process use 
Standard methods to achieve a consistent approach for the assessment of all events. These 
Standard methods usually involve different techniques. Each technique may have its 
particular advantages for cause analysis, depending on the type of failure or error. It is not 
possible to recommend any one single technique. Either one technique or a combination of 
techniques should be used in event analysis to ensure that the relevant 
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7. 


RADIATION PROTECTION 


7.1 ORGANISATION AND FUNCTIONS 

The Radiation Protection Programme is making progress to improve their standards and 
procedures. The RP department proactively seeks to support other departments in the 
development of procedures of work plans to improve the safety of the workers. However 
most of the remainder of the organisation is not currently actively contributing to efforts to 
reduce radiation exposure or prevent the spread of contamination. The team has made a 
recommendation that individuals and the other departments take greater ownership and 
accountability for ensuring radiological risks and exposure are maintained ALARA. 

The QA programme (Radiation protection Programme) contains goals, objectives, legislative, 
and international references, supporting documentation references. There is no site wide 
approved dose reduction programme or RP improvement programme. There is an intemal 
draft document for the RP department, but the plant is encouraged to make this a site owned 
programme. 

Dose constraints or KPI target settings for tasks and outages are not currently independently 
reviewed or challenged. Authorisations for RP roles are only given in-line by one person and 
there are no prescribed standards for plant knowledge, attitudes or behaviours which need to 
be attained for the various authorisations. The plant is encouraged to review its independent 
oversight of these key RP activities. 

Within the RP department, there are dedicated persons, who have a very high regard for 
personal and worker safety. They actively manage and support workers in the RCA to ensure 
that radiological Controls are applied. They maintain a very good knowledge and overview 
individually and within the team about what work is going on, through the RP weekly lead, 
attendance at the relevant meetings and very proactive information sharing. The team has 
considered this as a good performance. 

For RP staff, there are no practical linking training materials, courses or OJT guides which 
relate the learning of radiation protection to its application on a nuclear power station. The 
plant has started to bridge this gap and the team encourages this to continue. There is no 
specific radiation worker training programme to enable workers to know and understand the 
local rules and practical behaviours and practices which would enable them to apply better 
prevention techniques in the RCA for contamination control. The team encourages the plant 
to develop a radiation worker training programme. 

7.2 RADIATION WORK CONTROL 

The plant’s standards & expectations for behaviours and work practices for work in the RCA 
are not always set nor visible enough and are not adhered to by all workers, nor reinforced by 
coaching or observation in the RCA. There is a recommendation in the MOA area which 
reflects the team’s recommendations in this area. 

The plant’s routine work in the RCA is controlled largely by a basic requirement for persons 
to “check-in” at the RCA entrance with a lead RP technician. This allows good conversations 
and face-to-face acknowledgement of the Controls being imposed on the work. Nevertheless, 
experience at the plant and elsewhere shows that front-end planning and discussion with the 
radiation workers and RP together, allows better deployment of ALARA practices as is seen 
in the current arrangements for higher risk work. The team encourages the plant to review the 
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arrangements for the lower risk work (e.g. RWP for routine work to contain appropriate 
precautions). 

There are currently problems with using the work management software (asset suite 7) 
effectively to create the kind of Radiological Work Permits (RWPs) and instruetions required. 
The plant is encouraged to deliver the next version of the software in collaboration with RP to 
ensure that it meets the needs of a functional radiological work permit system (including 
interaction with the EPDs). 

Generally there are increasing Controls applied as the radiological risk increases. The 
methodology of the zoning can result in a lack of appreciation of high risk areas (>2mSv/h) 
as they are not clearly delineated from medium risk areas (>50uSv/h) as the red zone doserate 
boundary is very low. The ISO Standard required radiological risk signage is not currently 
used on all doors into the RCA and some doors can be opened to exit the RCA from the 
inside inadvertently by unauthorised persons without detection. The plant is encouraged to 
review these arrangements for protecting against spread of contamination and inadvertent 
entry of persons to controlled or higher risk areas. 

7.3. CONTROL OF OCCUPATIONAL EXPOSURE 

Routine monitoring of the plant rooms and the associated trending allows very simple and 
quick Identification of changes in dose rates and zoning. These are well communicated 
through a variety of means to the whole organisation and are identified as a good 
performance. The availability of the 3D photographic model of the plant to ensure that 
workers can visualise, measure and check their work plarming prior to entering high radiation 
zones is also a recognised good performance. 

Worker practices show a disregard for the importance of radiological exposure and 
contamination control. Recent plant events (person entering a high neutron area and personal 
contamination events) demonstrate that there are deficiencies in this area. The team has made 
a recommendation in this area. 

The current KPIs for RP assess significant events, but the plant is encouraged to trend lower 
level events and near misses in RP, such as contaminated items and equipment, plant 
contamination above action levels and capturing more detail on personal contamination 
events to enable detailed trending, analysis and cause identification. 

7.4 RADIATION PROTECTION INSTRUMENTATION, PROTECTIVE CEOTHING, 
AND FACIEITIES 

The frequency of routine function checks (simple testing against a source) does not meet 
current industry standards as it is not high enough. Also there is no complete QA system 
supporting the tracking of equipment use and checks carried out. The team encourages the 
plant to review this area for improvements. 

7.5. RADIOACTIVE WASTE MANAGEMENT AND DISCHARGES 

There is a build-up of historical equipment (which may be contaminated) in a room in the 
RCA. This equipment is not labelled with any radiological or owner Information nor 
wrapped. Active waste is segregated from “potentially clean” wastes. However, there is a lack 
of segregation of wastes at the source in the RCA, which results in increased amounts of 
sorting required later, using resources and incurring dose. The team encourages the plant to 
consider improving the management of active waste. 
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Although the plant’s discharges are well within authorized levels, the plant has voluntarily set 
themselves lower internal targets. Performance is monitored and improved within this target, 
even though not required by the regulator. This is a good performance. 

7.6. RADIATION PROTECTION SUPPORT DURING EMERGENCIES 

There is a lack of instrumentation available for intervention teams departing from the 
“bunker” facility (only one teletector, meaning that only one team can deploy and only one 
very small contamination instrument for checking of all persons at a control point). The plant 
is encouraged to review (in line with the EP issues) the adequacy of monitoring 
instrumentation. 

The fence monitoring system owned and monitored by the site is mainly passive and only 
contains one on-line gamma detector. Plans and funding are in place to replace this system in 
the next two years and the plant is encouraged to pursue this project with benefits for 
environmental, operational and emergency radiation protection. 
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DETAILED RADIATION PROTECTION FINDINGS 


7.1 ORGANISATION AND FUNCTION 

7.1(1) Issue: The plant workers and line management do not always take responsibility for 
ensuring their own or their team’s radiation protection and are not held aecountable when the 
required radiation protection behaviours and work practices are not achieved. 

The team made the following observations: 

- Some radiation workers do not understand the differences between radiation 
and contamination, nor the ways to prevent contamination spread; 

- Recent events show that workers have not taken basic, simple measures to 
prevent personal contamination spread; 

- There are very few supervisor observations of radiation workers in the RCA 
and no clear expectations that this should be undertaken. There is also no training given to 
enable them to undertake this effectively; 

- A large quantity of equipment is regularly abandoned at the entrance to the hot 
workshop over night or over the weekend, without identification of owners, contravening 
management expectations for notiiïcation; 

- There are only few dose reduction methods being undertaken by departments 
without RP initiation; 

- Radiation workers did not undertake actions to reduce their dose without being 
prompted by RP staff (e.g. moving away from areas of elevated doserate); 

- A recent significant event (entry into a room with high neutron doserate) 
demonstrates a lack of consideration of the importance of dose by an individual when 
entering a room; 

- There is no requirement for departments to undertake investigations for their 
own staff when site dose constraints are exceeded or persons are contaminated; 

- There are only department levels KPls for dose in maintenance, not for 
contractors. Operations, projects or chemistry. 

When workers and line management are not taking responsibility for their own radiological 
safety, dose is not controlled or reduced and contamination events will continue to occur. 

Recommendation: The plant should take measures to ensure that all workers and line 
management take responsibility for ensuring their own and their team’s radiation protection 
and should be held aecountable when the required behaviours and practices are not achieved. 
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lAEA Bases: 


SSR-2/2 

5.13. AU plant personnel shall understand and acknowledge their individual responsibility for 
putting into practice the measures for controlling exposures that are specified in the radiation 
proteetion programme. Consequently, particular emphasis shall be given to the training of all 
site personnel so that they are aware of radiologieal hazards and of the neeessary proteetive 
measures. 

GSR Part 3 

3.79 Employers, registrants and lieensees shall take such administrative actions as are 
neeessary to ensure that workers are informed that ensuring proteetion and safety is an 
integral part of a general occupational health and safety programme in which they have 
specific obligations and responsibilities for their own proteetion and the proteetion of others 
against radiation exposure and for the safety of sources. 

Requirement 22; 

Compliance by workers; 

Workers shall fulfil their obligations and carry out their duties for proteetion and safety. 
NS-G-2.7 

2.41. All site personnel are responsible for practicing measures to control radiation exposure. 
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7.3. CONTROL OF OCCUPATIONAL EXPOSURE 


7.3(1) Issue: The plant’s dose reduction and contamination control techniques and practices 

are not effective in ensuring doses and contamination spreads are as low as reasonably 

achievable (AEARA). 

The team made the following observations: 

- EPD doserate alarm is not set or used to allow individuals to be alerted to 
areas of higher doserates and hence reduce their doses; 

- The definition of a hot spot is very high (>2.5mSv/h) which in a green zone 
(<10mSv/h) could represent a significant unexpected exposure; 

- There is a high number of personal contamination events being recorded at the 
final exit of the RCA (More than 400 in the period Jan - Aug 2014); 

- There is no plant wide dose reduction programme; 

- Waste is sorted, handled and moved without adequate checks or labelling for 
doserate and contamination levels, additionally, there is a lack of use of long-handled 
tools and no use of extremity dosimetry where high doserates exist; 

- No benchmarking is performed to other plants for outage dose reduction 
techniques; 

- Only one camera was deployed during the 2014 outage and no remote 
Communications were used; 

- Remote monitoring of the primary circuit was undertaken in the last outage, 
but only one detector was deployed; 

- Practical dose reduction techniques for RP staff are not used e.g. remote 
monitoring, cameras & Communications devices; 

- Eimited and inconsistent production of post-job radiological survey reports; 

- Eoose contamination above expected levels is routinely found during surveys 
and when carrying out RCA clearance monitoring of tools and equipment; 

- Observed behaviours during CVCS pump overhaul demonstrated a lack of 
good contamination control practices e.g. the following where not used: wiping, 
monitoring, glove changes, restriction of potential spread during search for tools; 

- Room signage (zoning) is small and hard to read and is not routinely used by 
workers prior to room entry. It is often placed out of the line-of sight of persons entering 
high doserate rooms; 

- Inconsistent labelling of hot-spots does not allow individuals to understand 
easily where the risk and hazard is and where low doserate areas are; 

- The layout of the laundry does not allow a flow from a contaminated sorting 
table through to a clean area and contamination is often found in this area during routine 
surveys; 

- The hot workshop & decontamination facility has no air sampling routinely 
undertaken. 
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Without utilising adequate dose reduetion and eontamination eontrol methods, tools & 
teehniques, additional unnecessary dose is aeerued, workers are eontaminated and 
eontamination ean spread around the plant and into the environment. 

Recommendation: The plant should utilize various tools and teehniques to reduee doses and 
eontrol eontamination more effectively in normal operations, during projeets and in outages. 

lAEA Bases: 

SSR-2/2 

5.11. The radiation proteetion programme shall ensure that for all operational States, doses 
due to exposure to ionizing radiation in the plant or doses due to any planned releases of 
radioaetive material from the plant are kept below authorized limits and are as low as 
reasonably aehievable. 


NS-G-2.7 


3.67. For the eontrol of radiation exposure of persomiel, eonsideration of the optimization of 
radiation proteetion is required in the design and operation of a nuclear power plant in order 
to keep doses as low as reasonably aehievable, economie and social factors being taken into 
account. In line with this requirement, in examining working procedures and activities, the 
reduction of doses should be given the highest priority. A hierarchy of control measures 
should be taken into account in optimization. Firstly, removal or reduction in intensity of the 
source of radiation should be considered. Only after this has been done should the use of 
engineering means to reduce doses be considered. The use of Systems of work should then be 
considered and, lastly, the use of personal protective equipment. 

Methods of dose reduction that should be considered include: 

- Reducing radiation levels in work areas, for example, by the use of temporary 
shielding; 

- Reducing surface and airborne contamination; 

- Reducing working time in controlled areas; 

- Optimizing the number of workers in the work team; 

- Increasing the distance from the dominant radiation source; 

- Identifying low dose areas where workers can go without leaving the 
controlled area if their work is interrupted for a short time. 
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8. CHEMISTRY 

8.3 CHEMISTRY SURVEILLANCE PROGRAMME 

The chemistry program for radiochemical and Chemical parameters to be analysed is well 
developed and used effectively, however the pH of feed water is not in the parameter list. The 
conductivity of steam generator blow-down has only one action level and no corrective 
actions in the parameters’ list to be taken in the event of a deviance. The team encourages the 
plant to improve the quality control program in the Chemistry Department. 

The team identified as a good performance the development of a software tooi which will 
give advice to the technicians how to change the hydrazine dosage for control of secondary 
water quality. 

8.5 LABORATORIES, EQUIPMENT AND INSTRUMENTS 

The team identified as a good practice the environmentally controlled room in the nuclear 
laboratory. The accuracy of the chemistry instruments used for the analysis of samples related 
to plant safety is improved by their use in the environmentally controlled room. 

8.6. QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER 
SUBSTANCES 

The team identified as a good performance that the plant has access to an international 
database maintained by the plant designer which contains information about approved 
materials. The plant also has a software module for Asset Suite, the Material Safety Data 
Sheet, which is used to manage the receipt of goods that have possible Chemical impact on 
the plant. The data contained in the Material Safety Data Sheet is accessible to all staff and 
provides easy access to Chemical data for inclusion into work order packages. 

The team found examples of insufficiënt labelling, storing, handling Chemicals and hazardous 
materials. The plant work practices used when handling Chemicals and other hazardous 
materials are not always effective in ensuring that risks of personnel injury and equipment 
damage are minimized. The team has made a suggestion in this respect. 
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DETAILED CHEMISTRY FINDINGS 

8.5. LABORATORIES, EQUIPMENT AND INSTRUMENTS 

8.5 (a) Good practice: Environmentally controlled room in the nuclear laboratory 

Chemistry Instruments used for analysis of samples related to plant safety are loeated in an 
environmentally controlled room. This produces more accurate and consistent results for 
analysed parameters on the RCS and boron storage tanks. 

This room also functions as a cleanroom, because there is a continuous ventilation exhaust 
System, which reduces the likelihood of contaminating the samples and equipment. Better 
working conditions are also guaranteed, because temperature and humidity are stable and 
comfortable. Heat produced by the equipment in the room is removed effïciently. 

The plant implemented this room in 2013 as a part of laboratory renovation. In this room the 
measurements that are the most sensitive to variations in temperature and humidity are 
undertaken. The most important measurement is for B-10 in nuclear Systems, which is 
performed on the Inductive Coupled Plasma- Mass Spectrometer (ICP-MS). The ICP-MS is 
also used to measure metals in both nuclear and conventional Systems. Another device in this 
room is the Milli-Q, which produces pure water from tap water, and is used for preparation of 
Standard Solutions used for QA checks of the ICP-MS and other equipment. Ever since 
operation with the ICP-MS in this room, all of the Standard and background checks have been 
within specification. 
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8.6. QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER 
SUBSTANCES 


8.6(1) Issue: The plant work practices used when handling Chemicals and other hazardous 
materials are not always effective in ensuring that risks of personnel injury and equipment 
damage are minimized. 


The team made the following observations: 

- Face shields and gloves in building 09 were noted to be stored in a manner 
that would allow contamination and potential exposure to personnel when wearing the 
equipment; 

- The plant’s labelling requirements for Chemicals and other hazardous materials 
are not met in all instances. Examples include resin samples in the building 09, 
hazardous materials being stored in building 70, cleaning tanks for plant security cameras, 
Chemicals used for training and a plastic can containing petrol in building 15; 

- The plant is not effectively controlling hazardous materials in all cases; 

- Storing painting supplies in an unlocked container (11-283); 

- Storing open iron-sulphate bags in the turbine hall; 

- There is a barrel containing solid waste Chemicals in the laboratory Chemical 
store room. There is no listing of current contents of the barrel; 

- The plant procedure for receipt of hydrazine allows the new Chemical to be 
received prior to completing analysis for all contaminants. The quality certificate of the 
incoming hydrazine did not contain the sodium and fluoride parameters. Currently, the 
plant analyses for sodium and fluoride after receipt, which could lead to contamination of 
the entire tank; 

- The plant does not consistently take pre-emptive actions to preclude the spread 
of hazardous Chemicals to plant drainage Systems during Chemical offloads. There were 
two uncovered surface water drains near a hydrazine truck while it was being offloaded 
into the storage tank; 

- The current method for obtaining iron-sulphate tank samples does not provide 
convenient access to make sure samples are taken in safe conditions. 

Without following appropriate work practices with Chemicals and other hazardous materials, 

there is a risk of personnel injury and equipment damage. 


Suggestion: The plant should consider improving the work practices used when handling 
Chemicals and other hazardous materials to reduce the risks of persormel injury, releases to 
the environment, and equipment damage. 

lAEA Bases: 

SSR-2/2 

7.17. The use of Chemicals in the plant, including Chemicals brought in by contractors, shall 
be kept under close control. The appropriate control measures shall be put in place to ensure 
that the use of Chemical substances and reagents does not adversely affect equipment or lead 
to its degradation. 
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SSG-13 


9.3. The use of Chemicals and other materials at the plant, including those brought to the plant 
by contractors, should be controlled in accordance with clearly established procedures. The 
intrusion of non-conforming Chemicals or other substances into plant Systems can result in 
deviations in the chemistry regime, leading to component and System damage or increase of 
dose rates. The use of uncontrolled materials on the surfaces of the components may also 
induce damage. 


9.9. Chemicals and substances should be labelled according to the area in which they are 
permitted to be used, so that they can be clearly identified. The label should indicate the shelf 
life of the material. 


9.10. When a Chemical is transferred from a stock container to a smaller container, the latter 
should be labelled with the name of the Chemical, the date of transfer and pictograms to 
indicate the risk and application area. The contents of the smaller container should not be 
transferred back into the stock container. Residues of Chemicals and substances should be 
disposed of in accordance with plant procedures. The quality of Chemicals in open stock 
containers should be checked periodically. 


9.13. Management should periodically carry out walk downs of the plant to evaluate the 
effectiveness of the chemistry programme and to check for uncontrolled storage of Chemicals. 

ILO - SAFETY IN THE USE OF CHEMICALS AT WORK. 


6.9.3. (b) The handling of contaminated containers. Empty containers which have not been 
cleansed of hazardous Chemicals should be closed and stored to await disposal or reuse, and 
treated as if they contained those hazardous Chemicals. Empty containers should retain the 
Identification, marking and labelling of their previous contents. 
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9. 


EMERGENCY PLANNING AND PREPAREDNESS 


9.1. GENERAL 


The plant has created basis planning documents that identify the emergency response 
requirements for different scenarios. These documents cover a large spectrum of intemal and 
external events, including security threats. However, they do not provide a justification for 
the timing of the activation of the Alarm Organisation or the timing of the protective actions 
on-site and off-site. The team encourages the plant to review the timing requirements for 
emergency response. 


9.2. RESPONSE EUNCTIONS 


There are over sixty members of staff that are trained fire-fighters. In addition, professional 
fire-fighters from the town Borssele, and voluntary fire-lïghters from the region are 
mobilized quickly in the event of a Tire. The team has recognized these arrangements as a 
good performance that gives depth to the fire-fighting organisation. 


Several of the plant procedures describe arrangements that may introducé significant delays 
in the implementation of protective actions for on-site workers. The team recommended a 
review of these arrangements to ensure that on-site workers are protected in a timely manner. 


9.3 INFRASTRUCTURAL ELEMENTS 


Although the plant exercises regularly, there is no systematic process to ensure that all 
response functions are tested in exercises within a reasonable time period. In addition, some 
of the emergency arrangements have not been validated during an exercise and may not be 
effective during an emergency. The plant does not take full advantage of key performance 
indicators and operating experience to improve emergency preparedness. The team made a 
recommendation relative to the use of tools to validate all emergency functions and response 
capabilities. 


The training arrangements for on-site persoimel and external fire-fighters, ambulance, and 
security services are good, however the plant is encouraged to analyse the training needs for 
contractors potentially required to restore essential services on site or off site. 


The Plant organizes six full scale drills each year to ensure that all personnel with assigned 
duties exercise each year. The drills include the participation of one of the shift crew at the 
simulator, a complete on-site response organisation and full deployment of beyond design 
basis emergency mitigation equipment (diesel generators or pumps). The team recognized 
this as a good practice. 
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The Plant invites a professional trainer from the local lire training eentre and a trainer from 
the loeal hospital for some of the on-site drills. The team recognizes this as a good 
performance. 


The plant organizes an annual field exercise with a brigade of the Army of the Netherlands. 
These exercises provide training, test and validate the arrangements for support from the 
Army during a severe accident. The team recognized this as a good practice. 


DETAILED EMERGENCY PLANNING AND PREPAREDNESS FINDINGS 
9.2. RESPONSE FUNCTIONS 


9.2(1) Issue: The on-site emergency arrangements are not sufficiënt to ensure the timely 
protection of on-site workers in the event of an emergency. 


The following observations were made: 

- The plant’s fire-fighters do not have electronic dosimeters or gamma dose rate 
meters at the fire-station or in their vehicles. The electronic dosimeters are only available 
at the entrance of the radiation controlled area; 

- There are no visible numbers on buildings or doors outside the production 
facility. This may delay the response of emergency services such as the fire-fighters from 
the town of Borssele who come to assist the plant; 

- There are no emergency muster points for non-essential personnel inside the 
perimeter fence. In an emergency, non-essential persormel must exit through the access 
control System at the main gate, up to three at a time, and assemble at the canteen. When 
all exit gates are available, it takes 20 min to evacuate 250 people. With two gates 
available (a common issue) and more people on-site (during an outage), it could take 45- 
60 min to evacuate non-essential personnel. During that time, they would be lining up 
outside, unsheltered; 

- The procedures of the Shift Team Leader in the main control room include 
criteria for an orderly evacuation of the personnel in each building. However, his 
procedures do not allow for the urgent escape from the radiation controlled area, 
bypassing the inter-zone monitors. The procedure of the Site Emergency Director is the 
only one that contains instructions for such an escape; 

- There are no habitability criteria for the main control room after the ventilation 
has been placed in recirculation. If the measured dose rate in the main control room >10 
pSv/h, the operators put the ventilation into recirculation to protect from ingress of 
contamination to the control room. However, the dose rate could remain high because the 
large Windows in the main control room provide little shielding to exposure from the 
outside. 

Without on-site emergency arrangements that allow timely interventions, the protection of 

on-site workers in the event of an emergency may be jeopardized. 
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Recommendation: The plant should revise its on-site emergency arrangements to ensure that 
the on-site workers can be protected in a timely manner. 


lAEA Bases: 


GS-R-2; 


3.14. In designing a threat category I, II or III facility “[a] eomprehensive safety analysis is 
earried out to identify all sourees of exposure and to evaluate radiation doses that eould be 
received by workers at the [faeility] and the publie, as well as potential effeets on the 
environment...The safety analysis examines... event sequenees that may lead to [an 
emergeney]. On the basis of this analysis... requirements for emergeney [preparedness and] 
response ean be established. 


3.15. [...] The threat assessment shall be so condueted as to provide a basis for establishing 
detailed requirements for arrangements for preparedness and response by eategorizing 
facilities and practices eonsistent with the five threat eategories shown in Table I. 


4.12. When cireumstances neeessitate an emergeney response, operators shall promptly 
determine the appropriate emergeney elass (see para. 4.19) or the level of emergency 
response and shall initiate the appropriate on-site actions. The operator shall notify and 
provide updated information, as appropriate, to the off-site notilïcation point. 


4.20. [...] The criteria for classification shall be predefined emergency action levels (EALs) 
that relate to abnormal conditions for the facility or practice concerned, security related 
concerns, releases of radioactive material, environmental measurements, and other observable 
indications (see para. 4.70). The classification system shall be established with the aim of 
initiating a response prompt enough to allow for effective management and the 
implementation of emergency operations, including mitigation by the operator, urgent 
protective action and the emergency protection of workers. 


4.62. Arrangements shall be made for taking all practicable measures to provide protection 
for emergency workers for the range of anticipated hazardous conditions (see para 4.61) in 
which they may have to perform response functions on or off the site. 
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9.3 INFRASTRUCTURAL ELEMENTS 


9.3(a) Good practice: The plant organizes six site-wide integrated exercises each year to 
ensure that all personnel with assigned duties during an emergency participate in an exercise 
each year. 


Each exercise includes the participation of one of the shift crews at the simulator, a complete 
roster of personnel at the Alarm Coordination Centre, the security organisation, the 
maintenance organisation, the deployment of emergency mitigation equipment (diesel 
generators or pumps) which may involve the assistance of off-site contractors or the Army. In 
addition, the exercises are coordinated and conducted in collahoration with the external 
Emergency Response Organisations, which include: the Regional Centre of the Safety Region 
of Zeeland (VRZ), the nuclear regulatory hody (KFD), the National Institute for Public 
Health and the Environment (RIVM), the National Nuclear Assessment Team (EPAn), and 
the crisis centre of the plant designer (Krisenstag Areva). These organisations appreciate the 
opportunity for all their personnel to participate to an exercise. 


Once every five years, a national large scale exercise includes the participation of all 
ministries involved in the response to a large scale emergency, in addition to the participants 
to the annual exercises. 


9.3(b) Good practice: The plant organizes annual exercises with the 13 Armoured Brigade of 
the Netherlands Armed Forces. The tests involve support hy the Army for the deployment of 
heyond design basis emergency mitigation equipment, security, and decontamination. 

After the Fukushima accident, the plant made arrangements with the 13 Armoured Brigade to 
provide support in crisis situations. The 13 Armoured Brigade possesses a wide range of 
mobile equipment and means of transport to deliver resources anywhere. lts personnel is 
equipped and trained to operate under harsh conditions such as those encountered during a 
nuclear emergency. 


The agreement between the plant and the 13 Armoured Brigade includes participation in a 
yearly exercise where these arrangements are tested in the field. In 2012, the exercise 
involved the delivery of diesel fuel, a large mobile diesel generator, and operating crews 
during a simulated flood. During the 2013 exercise, the 13 Armoured Brigade performed 
monitoring and decontamination for 60 employees. It also arranged an emergency 
communication network. In November 2014, a third exercise is planned, which will involve 
radiation protection support on-site, and the off-site decontamination of vehicles that 
evacuated from the plant. The annual exercises also integrate a security component. 

These arrangements increase the robustness of the mitigation measures that were put in place 
by the plant as part of the Complementary Safety-margin Assessment - the European Union 
stress-test. 
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9.3(1) Issue: The plant does not use all available tools to comprehensively validate the 
adequaey of the emergeney funetions and response eapahilities. 


The following ohservations were made: 

- There is no multi-year exereise plan to ensure that all response functions are 
tested within a given time period; 

- When workers are found to be contaminated at the outer gate, or when the 
gates go into dose rate alarm, workers have to be cheeked manually for eontamination. 
These arrangements have not been tested reeently during an exereise; 

- The plant has not validated the eurrent arrangements for radiation proteetion 
personnel during an exercise that involves eontamination throughout the site; 

- The iodine thyroid blocking tablets (ITB) are stored at the seeurity office, near 
the main gate. According to the procedure of the Manager Support Services (MOD), the 
security personnel will distribute the ITB to emergency workers that remain on-site and to 
non-essential personnel at the canteen, which may introducé significant delays. The plant 
has not validated these arrangements during an exercise; 

- The plant identified a pond near the coal fired station that could be used to 
provide cooling water; however it has never tried to draw water from it using the fire 
pump truck from the on-site fire station. Experience shows that strainers at the water 
intake point can become clogged when such altemate sources of water supply are used; 

- Performance indicators for EPP are focused on exercises and training. There is 
a need to develop improved performance indicators that measure the effectiveness of the 
emergency preparedness programme; 

- There is no formal review of the operating experience database during 
revisions of the emergency management programme. The emergency preparedness group 
relies on the operating experience group for issues that may require actions. 

Without using all available tools to comprehensively validate the adequacy of all emergency 

functions and response capabilities, the plant may miss opportunities for improving the safety 

during emergencies. 


Recommendation: The plant should comprehensively validate the adequacy of all 
emergency functions and response capabilities considering exercises, effectiveness reviews, 
performance indicators, and operating experience. 


lAEA Bases: 


GS-R-2 


3.16. Operators, the national co-ordinating authority (see para. 3.4) and other appropriate 
organisations shall periodically conduct a review in order to ensure that all practices or 
situations that could necessitate an emergency intervention are identified, and shall ensure 
that an assessment of the threat is conducted for such practices or situations. This review shall 
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be undertaken periodically to take into account any changes to the threats within the State and 
beyond its borders, and the experienee and lessons from researeh, operating experienee and 
emergeney exereises (see paras 5.33, 5.37 and 5.39). 


5.33. Exercise programmes shall be eondueted to ensure that all speeified functions required 
to be performed for emergeney response and all organisational interfaees for facilities in 
threat eategory I, II or III and the national level programmes for threat eategory IV or V are 
tested at suitable intervals. 
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13. SAFETY CULTURE 


.1 GENERAL 
13.LI Descriptive analysis 

As result of the safety culture assessment at EPZ Borssele NPP for the descriptive analysis of 
the team identify the following: 

- Artefacts 

A theme of inconsistencies was observed across several parts of the organization. Specilïc 
examples are presented in the technical areas of the report. 

- Shared values 

Some examples of the organizations shared values include “Get it done”, “We need to be 
better to survive”, “We are very knowledgeable” and “My opinion is important”. 

- Basic assumptions 

Some examples of the organization include “We are safe”, “We are not very different from 
other power production companies” and “We have control”. 

- Self-Image 

These three clements of artefacts, shared values and basic assumptions create a “self-image” 
that drives the organizations performance and operate in a self-perpetuating mechanism that 
condemns the organization to repeat and to maintain the same inconsistencies, values and 
basic assumptions that provide a barrier for improvement. The non-challenging environment 
within the organization creates a further barrier that prevents the organization from effective 
and sustainable change. 

The self-image in believing that we are safe regardless of what we do, contributes to an 
environment of acceptance. Combined with the non-challenging aspect of the culture the 
inconsistencies are sustained without questioning safety. “Are we safe?” should be the 
challenge. 

This self-perpetuating mechanism challenges the organization by not considering all possible 
impacts on safety. The basic assumption of being safe is not challenged enough. Basic 
assumptions are by nature not conscious in an organization; the team believes this is the case 
for this organization as well. 


13.1.2 Normative analysis 


Once the descriptive analysis was completed the team compared the overarching themes with 
the lAEA Safety Culture Normative Framework and identified four themes. 


- Communication 

- Leaming organization 

- Organizational Change 
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Leadership 


These themes reinforce the self-perpetuating meehanism. In this way the four areas are 
prevented by the organizational eulture to effectively contribute to eontinuously improve 
safety by not ehallenging the self-image. 

13.2 COMMUNICATION 

The Young EPZ Professionals (YEP) was established as a response to rapidly ehanging 
employee demographies, this is reeognized as a good praetiee. 

Examples of good performanee in communication, identified by the team, inelude the 
Eeneioni team building initiative, effective eommunieation at the working level between 
different groups, a shared value that everyone’s opinion is important and experieneed 
employees openly share their views with others. 

However the team also identified that the organization’s eommunieation practices do not 
ensure that the importanee of nuclear safety is understood in all parts of the organization. The 
team made a reeommendation in this area. 

13.3 LEARNING ORGANIZATION 

Examples of good performanee of a leaming organization, as identified by the team, included 
the use of operating experienee in several instanees, reporting mistakes is eneouraged, that 
the threshold for reporting is perceived to be lower than in the past and safety eulture 
activities have been initiated. 

The team also identified that the organization does not realize and reinforce the importanee of 
learning from experienee. The team has made a reeommendation in this area. 

13.4 ORGANIZATIONAE CHANGE 

A positive aspect, identified by the team, was that formal documentation on organizational 
change reflects an appropriate understanding of risk implication. 

The team identified that changes in organizational structure, function, leadership, policies, 
programmes, procedures and resources do not always consider safety implications and are not 
effectively communicated and implemented. 

The team made a reeommendation in this area. 


13.5 LEADERSHIP 

Good performance was identified by the team in the positive relationship between supervisors 
and their immediate workers, and by employees expressing satisfaction and pride in working 
for the organization. 

The team also identified that leadership for safety is not reeognized throughout the 
organization to ensure sustainable safety performance and made a reeommendation in this 
area. 

The team recognizes that the organization has initiated several improvement activities related 
to human and organizational factors. These initiatives related to management, leadership and 
culture for safety have been formulated in a compartmentalized manner and demonstrate a 
lack of understanding of the necessity to consider the interaction between human, technical 
and organizational factors in a systemic approach to safety. Subsequently the team 
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encourages the organization to consider the self-perpetuating mechanism that has been 
identified and described in its improvement process. 
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DETAILED SAFETY CULTURE FINDINGS 


13.2 COMMUNICATION 

13.2(a) Good practice: The Young EPZ Professionals (YEP) was established as a response 
to rapidly changing employee demographics. YEP provides young employees with an 
opportunity to discuss, comment, exchange knowledge and contribute to the development of 
EPZ. 

The arrival of many new eolleagues at EPZ the past years eonsiderably redueed the average 
age of employees. The partieular processes and the department-oriented thinking at EPZ, 
however, makes it rather diffieult to meet with other eolleagues with whom one is not 
working together on a daily basis. In response to this, Young EPZ Professionals (YEP) was 
established by a group of motivated eolleagues to help increase the eommunication and 
interaetion in the organization. A kick-off meeting was held in December 2012. The target 
audience consists of all EPZ employees under the age of 35 which currently consists of 102 
people. Fifty five of these individuals currently belong to YEP. 

YEP provides young EPZ eolleagues the opportunity to exchange knowledge and experience 
as they often face similar challenges in their daily work. By meeting regularly and 
facilitating discussions on current issues and developments within EPZ, YEP works to 
contribute positively to achieving the organization’s goals to enhance personal development 
on the other. Discussions, think tanks and workshops are facilitated on issues such as “how to 
improve FME policy”, “how to apply and communicate EPZ’ rules of conduct” and “how to 
improve EPZ if you were a manager”. The results of such activities are documented and 
formally presented to the relevant EPZ employee for his or her consideration. YEP further 
contributes to strengthening EPZ eommunication by arranging regular informal meetings 
with members of the EPZ management, eommunication with professional and functional 
levels within EPZ as well as various teambuilding events for EPZ members. YEP also 
facilitates eommunication and cooperation with young professional peers outside of EPZ. 

Examples of results in relation to nuclear safety: 

- YEP discussed the FOCUS 2 with the Senior Management team. Based on this 
discussion, the action plan was modified. 

- YEP had a presentation on Eean Six Sigma, and after that, YEP asked for a 
more structured approach to implement Eean Six Sigma at EPZ. Due to this request, 4 
lean six sigma projects started in 2014, and these projects are anticipated to help make 
significant improvements in 4 processes. 

- YEP discusses with managers and workers all over the company about 
organizational and cultural issues. They try to break organizational barriers. 
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13.2(1) Issue: The organization’s communication practices do not ensure that nuclear safety 
is understood in all paris of the organization. 


The following observations were made: 

- The laek of direct and open communication within and between the various 
management levels (corporate organization and the plant) can jeopardize nuclear safety. 
There are essential problems of: 

- Laek of trust; 

- Power dynamics; 

- One-way communication; 

- Top-down communication; 

- Discussions rather than dialogues. 

- The laek of direct and open communication vertically throughout the 
organization is a critical problem due to the similar aspects mentioned above. 

- The working level of the organization is not suffïciently kept formally 
informed, which creates a window for rumours and laek of trust. Some examples of laek 
of information are: 

- The Vision of the future; 

- The organizational changes; 

- The departure of some managers; 

- The conditioned licence to operate, i.e. to be in the first quartile; and 

- What is going on in other departments? 

- The organizations approach to communication does not close the loop to 
ensure that people have a shared understanding. There is: 

- Laek of three way communication; 

- Laek of requesting and providing feed-back; 

- Overreliance on email, intranet, posters, and booklets. 

- The organization needs to revise the communication provided to contractors 
about radiological risks as there is evidence of people being concemed about working in a 
nuclear power plant. 

- There is an attitude that problems should not be raised without Solutions. This 
has to be attended to as it can create a “good news” culture, which filters out important 
safety related information. 

- Many individuals, both workers and managers perceive that too much time is 
spent in meetings which take time away from doing work in the field. 

Without clear, open and interactive communication through all parts of the organization, 

nuclear safety might not be fully understood. 
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Recommendation: The organization should improve its communication practices to ensure 
that the importance of nuelear safety is understood by all organization staff. 

lAEA Bases: 


GS-R-3 


2.5. The management system shall be used to promote and support a strong safety culture by: 

- Ensuring a common understanding of the key aspects of safety culture within 
the organization; 

- Providing the means by which the organization supports individuals and teams 
in carrying out their tasks safely and successfully, taking into account the interaction 
between individuals, technology and the organization; 

- Reinforcing a learning and questioning attitude at all levels of the 
organization; 

- Providing the means by which the organization continually seeks to develop 
and improve its safety culture. 

GS-G-3.5 

2.10. Senior management should establish and promote a set of principles to be used in 

decision making and promoting safety conscious behaviour. Examples of such principles used 

in some organizations are as follows: 

(a) Everyone has an impact on safety. 

(b) Managers and leaders must demonstrate their commitment to safety. 

(c) Trust and open communication permeate the organization. 

(d) Decision making reflects putting safety first. 


(i) A proactive approach to safety is taken. 

(j) Safety is constantly under review. 

Appendix I 

I SAFETY IS A CEEARLY RECOGNIZED VAEUE 

(a) The high priority given to safety is shown in documentation, Communications and 
decision making 

II EEADERSHIP FOR SAFETY IS CEEAR 

(c) There is visible leadership showing the involvement of management in safety related 
activities 

(h) Management shows a continual effort to strive for openness and good communication 
throughout the organization 

(i) Relationships between managers and individuals are built on trust 
IIIACCOUNTABIEITY FOR SAFETY IS CEEAR 

(b) Roles and responsibilities are clearly defmed and understood 
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IV SAFETY IS INTEGRATED INTO AEE ACTIVITIES 
(a) Trust permeates the organization 

(f) Factors affecting work motivation and job satisfaction are considered 
(h)There is cross-functional and interdisciplinary cooperation and teamwork 

V SAFETY IS LEARNING DRIVEN 

(a) A questioning attitude prevails at all organizational levels 

(b) Open reporting of deviations and errors is encouraged 
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13.3 LEARNING ORGANIZATION 


13.3(1) Issue: The organization does not realize and reinforee the importanee of learning 
from experienee on the basis of an effeetive proeess. 

While there are some examples that operating experienee is identified, the organization is 
missing opportunities to use this information as part of a learning proeess. 


The following observations were made: 

- There is a pereeption among some employees that not enough use of operating experienee 
from other industries is used at the plant; 

- There is no human factors expertise in the organization, e.g. in the OE team; 

- Use of internal and extemal OE is not systematically integrated into routine activities, e.g. 
PJB, turnovers, revision of plant’s documents; 

- The value of a comprehensive and effeetive Corrective Action Program (GAP) 
for plant performance improvement is not being realized; 

- Managers are required to report at least 10 near misses (NM) and low-level events (LEE) 
per year. Other personnel must report at least 2 near miss (NM) and low-level events 
(LEE) per year. This information is not being tracked or trended and in several 
departments the managers are not meeting the requirements; 

- There is reluctance on the part of supervisors to report any issue regarding organisational 
or behavioural aspects observed in the field; 

- Corrective actions from repeat events are not always identified and Common Cause 
Analysis is not conducted; 

- System health reports are not produced and the reporting of different aspects 
of Systems is fragmented. There is no integrated assessment of System health provided for 
use in learning and understanding the status of the overall plant; 

- Some of the plant’s important processes do not have appropriate KPls (EPP, 
risk management, and portfolio management). The use of KPIs by themselves does not 
ensure quality of work and this needs to be better understood and evaluated; 

- There is a pereeption among some employees that the historical and 
organizational knowledge in the organization is rapidly diminishing. The implications for 
learning and maintaining a good knowledge base in nuclear safety is troublesome. 
Examples identified include: 

- Many senior people with most of the plant experienee and knowledge are 
leaving; 

- The Engineering Department is concemed about lack of experienced engineers 
and knowledge with respect to the design basis of the plant; 

- There is lack of experienee in core design at the plant; 

- Some skills rest with only one or two people. 

- An individual’s annual dose report is sent to their home hut many individuals 
have identified that they don’t know how to interpret the information. 
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Without realizing and reinforcing the importance of learning from experience on the basis of 
an effective proeess the organization is missing the opportunity to leam and continuously 
improve safety. 

Recommendation: The organization should realize and reinforce the importance of learning 
from experience on the basis of an effective process 

lAEA Bases: 


GS-R-3 

2.5. The management system shall be used to promote and support a strong safety culture by: 

- Ensuring a common understanding of the key aspects of safety culture within 
the organization; 

- Providing the means by which the organization supports individuals and teams 
in carrying out their tasks safely and successfully, taking into account the interaction 
between individuals, technology and the organization; 

- Reinforcing a learning and questioning attitude at all levels of the 
organization; 

- Providing the means by which the organization continually seeks to develop 
and improve its safety culture. 


GS-G-3.1 


Safety is learning driven: 

- A questioning attitude prevails at all organizational levels. 

- Open reporting of deviations and errors is encouraged. 

- Intemal and external assessments, including self-assessments, are used. 

- Organizational experience and operating experience (both intemal and 
extemal to the facility) are used. 

- Leaming is facilitated through the ability to recognize and diagnose 
deviations, to formulate and implement Solutions and to monitor the effects of corrective 
actions. 

- Safety performance indicators are tracked, trended, evaluated and acted upon. 

- There is systematic development of individual competences. 


GS-G-3.5 
Appendix I 

II LEADERSHIP POR SAFETY IS CEEAR 

(c) There is visible leadership showing the involvement of management in safety related 
activities. 
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(e) Management ensures that there are suffieient competent individuals. 

IV SAFETY IS INTEGRATED INTO ALE ACTIVITIES 

(d) The quality of processes, from planning to implementation and review, is good. 

(e) Individuals have the necessary knowledge and understanding of the work processes. 

V SAEETY IS LEARNING DRIVEN 

(b) Open reporting of deviations and errors is encouraged. 

(c) Intemal and extemal assessments, including self-assessments, are used. 

(d) Organizational experience and operating experience (both intemal and external to the 
installation) are used. 

(e) Learning is facilitated through the ability to recognize and diagnose deviations, to 
formulate and implement Solutions and to monitor the effects of corrective actions. 
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13.4 ORGANIZATIONAL CHANGES 


13.4(1) Issue: Changes in organizational structure, function, leadership, policies, programs, 
procedures, and resources do not always consider safety implications and are not effeetively 
communicated and implemented. 


The following observations were made: 

- The reason for change, whether it be organizational, process, personnel or 
teehnieal are not clearly eommunicated or understood; 

- Transition of the coal plant personnel into the nuclear plant is perceived to be lacking a 
elear strategy. Management has not yet told the staff when it will present the plan; 

- The reorganization (FOCUS 2) is perceived to be necessary beeause of the pressure of 
cutting costs to be able to operate until 2034. Coneern about how to manage the pressure 
has resulted in rumours that management will shut down the nuclear plant earlier; 

- The work management system is still not understood. Small jobs are described as difficult 
to perform since they have to be done in the same way as large jobs; 

- There are a lot of ongoing changes sueh as teehnieal modifications and organizational 
changes that are still not fmished and it is not elear why; 

- Since 2010 a considerable number of managers have changed, including 4 different plant 
managers, and it was not understood by plant personnel how it would improve the 
organization; 

- The Change Management Procedure has not been applied to key organizational projects. 

- Even though several Information meetings with the personnel have taken place, many of 
the personnel believe that the organization has already implemented FOCUS 2 but in faet 
that change has not yet been officially eondueted; 

- The process of change in the organization does not consider the impact of the 
ehange on the personnel that are involved; 

- Personnel deseribe that they are generally not involved in the organizational change 
process; 

- Operators in the control room are getting many questions about how to do work within 
the new software system and work management system beeause of incomplete 
implementation and inadequate training for the personnel who must do their jobs with 
these Systems; 

- The root eauses identified in the significant event related to valve in TJ031 were linked to 
the implementation of the work management system. Standards were insufficiently 
eommunicated, jobs were understaffed, there was insufficiënt management involvement, 
and delays in implementation; 

- Decisions to implement change are originating from the upper level in the 
organization without the input from those who will be impacted by the change. After 
implementation it becomes too resouree intensive to formally change the proeess; 
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Change is often made more complex and complicated than it should be 
because of the informality and lack of clarity in implementation; 

AP928 originally had 35 steps when it was first implemented. After all 
departments provided their input (RP, CH, OPS, MA) it ended up with 75 steps. The 
original system had more flexibility but by adding more detail and moving away from the 
formal system it became more complicated; 

When people say "there has been a reorganization”, people first ask- "which 

one"? 


- The change to the work permit system has worked well in other companies but 
not in this organization. The personnel that knew the system the best left the company and 
there are a lot of things still required to complete the system. Many personnel have made 
their own informal modifications to make the system work for them. 

- The value that everyone’s opinion is important is perceived not to be in 
balance. It is expressed that peoples involvement in the decision-making process 
sometimes is hindering from moving forward. There is a difference between the less 
experienced persoimel who want to make decisions and changes quickly with the more 
experienced personnel who would like to take more time. 

- The plant has implemented organisational changes that impact on safety. 
Implementation of the Nuclear Safety section was not analysed. 

Focus 3 is currently in implementation and concerns safety culture and the basis for 
improvement in the organization. Persoimel are not aware that FOCUS 3 is ongoing and 
some management indicates that the new organizational structure and processes are required 
to start this programme. The confusion around the status of FOCUS 2 and FOCUS 3 is 
symptomatic of the problems in change management in the organization. Organizational 
changes need to be planned, controlled, communicated, monitored, tracked and recorded to 
ensure that safety is not compromised. 

Recommendation: The organization should incorporate safety consideration in changes in 
organizational structure, function, leadership, policies, programs, procedures and resources 
and effectively communicate and implement these changes. 

lAEA Bases: 


GS-R-3 


5.28. Organizational changes shall be evaluated and classified according to their importance 
to safety and each change shall be justified. 

5.29. The implementation of such changes shall be planned, controlled, communicated, 
monitored, tracked and recorded to ensure that safety is not compromised. 


GS-G-3.1 


5.56. When organizational change is necessary, no reduction in the level of safety achieved 
should be acceptable, even for short periods of time, without appropriate justification and 
approval. 
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5.57. The drive to improve effïcieney and reduce costs can result in organizational changes 
that can have significant safety implications. Examples of such changes are: 

- Mergers of organizations, leading to a drive for harmonized standards and 
procedures; 

- Changes in the arrangements for providing central support services; 

- Reassignment of work activities, thereby increasing the likelihood that 
expertise in critical areas will be lost; 

- Changes in the policies for recruitment, selection, induction and training of 
individuals; 

- Reductions in the number of management levels and in the grades of 
individuals carrying out activities in the organization. 

5.58. When major organizational changes are planned, they should be rigorously and 
independently scrutinized. Senior management should remain aware that it has the ultimate 
responsibility for safety and should ensure that safety considerations are given a priority 
commensurate with their significance during any process of major change. 

5.60. For changes for which it is judged that potentially significant effects on safety could 
arise, assessments should be carried out to ensure that the following factors are considered: 

- The final organizational structure should be fully adequate in terms of safety. 
In particular, it should be ensured that adequate provision has been made to maintain a 
sufficiënt number of trained, competent individuals in all areas critical to safety. It should 
also be ensured that any new processes introduced are documented with clear and well 
understood roles, responsibilities and interfaces. All retraining needs should be identified 
by carrying out a training needs analysis of each of the new roles. The retraining of key 
individuals should be planned. These issues are especially important if individuals from 
outside the organization are to be used for work that was previously carried out intemally, 
or if their roles are to be otherwise substantially extended; 

- The transitional arrangements should be fully adequate in terms of safety. 
Sufficiënt personnel with knowledge and expertise that are critical to safety should be 
maintained until training programmes are complete; 

- Organizational changes should be made in such a way as to maintain clarity 
about roles, responsibilities and interfaces. Any significant departures from pre-planned 
transitional arrangements should be subject to further review. 

5.61. Senior management should develop a specific process to manage and review 
organizational changes. The process should ensure that there is no degradation in the safety 
culture of the organization. 

5.62. A safety assessment should be developed for any changes that have the potential to 
affect safety. For more significant changes, advice should be sought from intemal and 
external experts. 

5.64. Communication with interested parties, including individuals, should be carried out 
honestly and openly, addressing the safety implications and other implications of the changes 
and explaining the steps being taken. The appropriate mechanisms for the feedback of 
information to monitor the effects of the changes that are implemented should be set up. 
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5.65. For each change, the project leader should apply a systematic and transparent project 
management process, the rigour of which should be commensurate with the signilïcance of 
the change. In parallel, senior management should consider the overall integration of all 
changes, and should oversee very significant changes that are imposed and the cumulative 
effects of smaller changes that may interact with each other. Effects on ongoing activities 
during the implementation of changes should be studied well and given careful consideration. 

5.66. For each project for change proposed, the risks to the objectives of the organization, 
including safety, health, environmental, security, quality and economie risks, should be 
identified and evaluated. 

5.67. The interactions between different changes should be given careful consideration. 
Changes that on their own may have only a limited effect on safety may combine and interact 
to produce much more significant effects. Where possible, different initiatives for changes 
that are pursued at any one time and that may affect safety should be minimized. In addition, 
the total workload imposed on the organization to implement the changes in parallel with 
continued operational activities should be given careful consideration. 

5.68. The individual who has the authority to approve changes to be implemented should be 
clearly designated. For each change, and on the basis of the significance of the change, 
Controls should be applied to ensure that it is possible to identify the individual in the 
organization who is authorized to approve the change. 

GS-G-3.5 

2.25. Major initiatives for changes that affect the safety culture should not be launched 
prematurely. A careful approach should be taken initially to ensure that everyone understands 
the new way of thinking and working, and to consider how the existing culture could help or 
hinder the new culture. The desired changes should build on the existing culture. It should be 
considered how the individuals who are the targets for change could be motivated to want to 
change, but such individuals should not become so anxious about leaming new things as to 
resist change. Consideration should be given to how the existing culture can help the learning 
process and make individuals feel secure. 

2.26. A major challenge in changing the safety culture is to develop a leaming organization 
that will continually be able to make its own diagnosis, and to self-manage whatever 
transformations are necessary as the environment changes. An organization of this type is 
likely to be far more resilient and successful in dynamic, fast changing economie conditions. 
Ideally, all individuals should be involved in proactively contributing ideas for 
improvements. More sustainable approaches would involve encouraging individuals to work 
in teams and continually seek improvements by identifying and prioritizing actions to 
enhance safety in their own work areas. To facilitate this, individuals should be given the 
opportunity to compare their way of working with that of others, so that they are aware of 
what constitutes excellence in their area of work 

3.23. Organizations should promulgate a policy for promoting and managing change that 
encompasses their vision and values. This policy for change management: 

(a) Should give priority to safety; 

(b) Should address all types of change; 

(c) Should introducé the process for change management; 


83 


SAFETY CULTURE 



(d) Should state that only approved changes will be implemented; 

(e) Should promote effective communication. 


GS-G3.5 

Appendix 

II LEADERSHIP FOR SAFETY IS CEEAR 

(g) Safety implieations are eonsidered in ehange management proeesses. 

IIIACCOUNTABIEITY FOR SAFETY IS CEEAR 

(a) An appropriate relationship with the regulatory body exists that ensures that the 
aeeountability for safety remains with the lieensee. 

IV SAFETY IS INTEGRATED INTO AEE ACTIVITIES 

(d) The quality of proeesses, from planning to implementation and review, is good. 

(f) Faetors affecting work motivation and job satisfaetion are eonsidered. 
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13.5 LEADERSHIP 


13.5(1) Issue: Eeadership for safety is not recognized throughout the organization to ensure 
sustainable safety performance. 

The following observations were made: 

- The organization has a culture of allowing people opinions after decisions are 
made. This is expressed to be adding complexity as layers of details are added. This 
often creates delays in the implementing process, which can have a negative impact on 
safety; 

- Personnel coming from other industries are puzzled that people at the nuclear 
power plant are not expected to take accountability for their actions. For example: 

Many managers do not take their role as leaders to follow up that agreed upon 
actions have been fulfilled; 

Several employees have stressed the fact that it is accepted that people avoid 
taking ownership; 

There is a general acceptance of not meeting timelines (delays in the inputs to 
the work management process, crane in the reactor building); 

In the survey 19% of the respondents answered that they don’t think 
management communicates effectively about safety. 

- The communication and enforcement of consequences when personnel are not 
fulfilling expectations or adhering to mies not being done, e.g. when a new procedure was 
going to be implemented an additional procedure was written on how to handle the 
situation when the new procedure was not followed. While there are a few examples of 
good leadership for safety it must be stressed that most of the managers do not spend 
sufficiënt time in the field or with the personnel. The following have been expressed by 
working level persormel: 

- Personnel seldom or never sec managers in the field, even their own 
department managers; 

- The perception that managers prefer to be in meetings or hiding behind their 
desk; 

- Plant KPls for managers in the field shows a decrease in the participation in 
several departments; 

- There is also evidence for this in the survey results as in the area within 
'leadership for safety is clear' the most negatively answered question is about 
management visibly present in the field (negative 46%). 

- Most of the interviewees and participants in the focus groups would like to see 
a change in the management and leadership to become better in : 

- giving clear direction and taking the lead in decisions; 

- providing personal feed-back; 

- talking to people; 
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- be better in listening; 

- utilize people’s knowledge before implementing new Systems; 

- be more transparent (referring to rationale behind deeisions and terminations of 
some managers); 

- resolving the collaboration problems in the senior management team; 

- understanding how to manage a power plant with referenee to nuclear knowledge; 

- explain the rationale behind crueial deeisions; 

- foeusing on the nuelear power operations 

In general there is an underestimation of the value and importanee of 
leadership for safety. This is deseribed above and in the lack of program for leadership 
development. 

Confidence eoneeming operational safety in some of the senior 
management team despite of laek of experienee. 

AU levels of personnel aggressively question the management strueture and its 
functionality. It is referred to as an upside down triangle or rowing a boat with one man 
rowing and seven men giving direetions. Atension exists between the eorporate management 
and the nuelear plant management, whieh is ereating a laek of trust. 

Without an effective leadership elearly expressing the value of safety in the organization there 
is a risk that safety does not have an overriding priority. 

Recommendation: The senior management should establish an effective leadership that 
elearly express the value of safety to ensure sustainable safety performance. 

lAEA Bases: 

SSR-2/2 

3.5. The management system shall integrate all the clements of management so that processes 
and activities that may affect safety are established and conducted coherently with other 
requirements, including requirements in respect of leadership, protection of health, human 
performance, protection of the environment, security and quality, and so that safety is not 
compromised by other requirements or demands. 

4.2. The safety policy shall stipulate elearly the leadership role of the highest level of 
management in safety matters. Senior management shall communicate the provisions of the 
safety policy throughout the organization. Safety performance standards shall be developed 
for all operational activities and shall be applied by all site personnel. All personnel in the 
organization shall be made aware of the safety policy and of their responsibilities for ensuring 
safety. The safety performance standards and the expectations of the management for safety 
performance shall be elearly communicated to all personnel, and it shall be ensured that they 
are understood by all those involved in their implementation. 


GS-G3.5 

Appendix 
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I SAFETY IS A CLEARLY RECOGNIZED VAEUE 

(f) The high priority given to safety is shown in documentation, Communications and 
decision making. 

(g) Safety is a primary consideration in the allocation of resources. 

(d) Individuals are convinced that safety and production go hand in hand. 

(e) Aproactive and long term approach to safety issues is shown in decision making. 

(f) Safety conscious behaviour is socially accepted and supported (both formally and 
informally). 

II EEADERSHIP EOR SAFETY IS CEEAR 

(h) Senior management is clearly committed to safety: 

(i) Commitment to safety is evident at all levels of management: 

(j) There is visible leadership showing the involvement of management in safety related 
activities: 

(k) Eeadership skills are systematically developed: 

(l) Management ensures that there are sufficiënt competent individuals: 

IIIACCOUNTABIEITY FOR SAFETY IS CEEAR 

(d) Management delegates responsibility with appropriate authority to enable clear 
accountabilities to be established: 

(e) ‘Ownership’ for safety is evident at all organizational levels and for all personnel. 

IV SAFETY IS INTEGRATED INTO AEE ACTIVITIES 
(a) Trust permeates the organization. 

(f) Factors affecting work motivation and job satisfaction are considered. 

(g) Good working conditions exist with regard to time pressures, workload and stress. 

(h) There is cross-functional and interdisciplinary cooperation and teamwork. 

(i) Housekeeping and material conditions reflect commitment to excellence. 

V SAFETY IS EEARNING DRIVEN 

(a) A questioning attitude prevails at all organizational levels. 

(b) Open reporting of deviations and errors is encouraged. 

(f) Safety performance indicators are tracked, trended and evaluated, and acted upon. 

(g) There is systematic development of individual competences. 
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14. SEVERE ACCIDENT MANAGEMENT 


14.1 OVERVIEW OF SEVERE ACCIDENT MANAGEMENT 

The development of the plant SAM Programme uses experienee and results from the 
Pressurised Water Reactor Owners Group (PWROG). This can be considered as an optimum 
decision, since the PWROG approach is internationally recognized as a comprehensive and 
consistent set of strategies for addressing all challenges associated with severe accident. 
Implementation of PWROG generic guidelines to original SIEMENS KWU design required 
some plant modifications and support from the original plant designer (AREVA). The team 
encourages the plant to continue its cooperation with the supplier of original Emergency 
Operating Procedure (EOPs) and Severe Accident Management Guidelines (SAMG) to 
implement new experienee and results from PWROG. 

14.2 ANAEYTICAE SUPPORT FOR SEVERE ACCIDENT MANAGEMENT 

The original strategies are based on analyses performed during the development of the 
generic strategies and modified (when necessary) on a plant specifïc basis. The plant specific 
analyses used for strategy development are (a) deterministic analyses performed by AREVA 
during design modification, (b) PSA insights and supporting analyses performed by NRG, 
SCIENTECH etc. and (c) analyses for licence purpose performed by AREVA. The supporting 
analyses cover the progression towards severe accidents in the reactor core (both at power 
conditions and shutdown reactor) as well as in the spent fuel pool. 

Major upgrades that are foreseen based on identified measures in the Complementary Safety 
Margin Assessment (CSA) will significantly influence the selection of severe accident 
management strategies, their timing, prioritization and effectiveness. The team encourages 
the plant to update the relevant analyses to address all possible influences from the proposed 
measures in CSA. 

14.3 DEVEEOPMENT OF PROCEDURES AND GUIDEEINES 

Accident management extends from the preventative part in the EOPs domain to the 
mitigating part, known as the SAMG domain. The plant specific Westinghouse based EOPs 
and functional restoration procedures have been implemented for preventing core damage. 
When working in the EOP-domain, there is a person (Deputy Shift Leader) in the main 
control room who monitors critical safety functions and triggers the transfer to function 
restoration, when exceeding a set of critical safety function criteria. The criteria for entering 
the SAMG domain are precisely specilïed for both the reactor core and the spent fuel pool. 
As long as the Technical Analysing Group (TAG) is not staffed or not ready to respond, the 
control room operators follow the severe accident control room procedures (two procedures 
for at-power plant initial state). The third procedure specifically for plant shutdown States is 
not developed yet. 

Not all abnormal operation procedures and EOPs are implemented and hence the abnormal 
operation procedures and EOPs do not address all possible plant States. Also no formal 
procedure for SAM procedures and guidelines development exists. A suggestion was made by 
the team in this area. 

Requirements for availability, allo wed outage times, required actions and surveillance 
requirements of some SAM equipment are included in a separate Plant Technical- 
Specifications (BTS). The team considers this as a good practice. 
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The SAMGs contain attachments with system line-ups that can be used to achieve certain 
flow paths (mostly the non-standard flow paths not familiar to the personnel). The plant has 
a complete set of up-to-date process diagrams available for every system line-up that is 
mentioned in the SAMG and a software tooi to maintain them. The team considers this also 
as a good practice. 

14.4 PLANT EMERGENCY ARRANGEMENTS WITH RESPECT TO SAM 

SAM functions and responsibilities are included in Emergency Response Organisation (ERO) 
and are clearly described. The ERO is structured to support all required SAM functions in the 
preventive and mitigative phases. The criteria, responsibilities and required time response for 
activation of the SAMG users are adequate. All SAMG users available would be involved if 
accident was progressed to severe accident. If the SAMG users are not mobilized when the 
transition from EOPs to SAMG is required, the control room operators use dedicated 
procedures until ERO members responsible for SAM are present and ready to assume their 
function. 

The access and habitability of the corresponding locations of the teams of evaluators and 
implementers have been assessed from the points of view of security, industrial safety and 
radiation protection. The team has recognized as a good performance that information about 
dose rate predictions in locations of the teams of evaluators and implementers is described in 
the corresponding procedure. 

The team has recognized as a good performance that all teams of the emergency response 
organisation are provided with on-line data from the process computer. On-line data is 
available in the main control room, in the TAG room in the ERC, in the KFD's office and 
also in AREVA, Krisenstab. If normal communication means are lost, then altemative 
communication means are available (implemented in the scope of post-Fukushima measures). 

14.5 VERIFICATION AND VAEIDATION OF PROCEDURES AND GUIDELINES 

EOPs are validated on the control room simulator (CRS) during operators training and there 
are no special sessions for validation. CRS capabilities are restricted and do not allow 
validation of the full range of EOPs. 

Verification of the SAMGs was performed within the vendor's QA process during the 
development of the guidelines. In addition the guidelines were independently reviewed by the 
plant staff. The validation included demonstration by analysis of feasibility and effectiveness 
of the proposed SAMG actions. The “table top” exercises were mainly used for a limited 
scope of validation. 

SAM procedures and guidelines verification and validation are regularly performed, however 
no dedicated procedure for validation exists. The conclusions of the validation are 
documented in the intemal database only and no systematic approach for validation process 
documentation exists. The plant SAMGs are not reviewed and updated on a regular basis and 
the plant does not use international feedback from the PWROG. When new severe accident 
issues occur, Westinghouse updates their generic SAMG, but this information is not 
systematically used at the plant. It should be emphasised that updating the SAMGs and 
validating them will be necessary in connection with the planned upgrading of the plant 
hardware features for mitigation of severe accidents. A suggestion was made by the team in 
this area. 
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14.6 TRAINING NEEDS AND TRAINING PERFORMANCE 

Several kinds of training are provided to individuals and groups involved in the application of 
the SAMGs. The SAM personnel have adequate qualification and training to provide 
qualified support. The training is foeused on all aspeets of SAM ineluding the analysing of a 
real aecident hy TAG and expectations from AREVA Krisenstab. Also new information is 
regularly provided during refresher training. 

The team has reeognized a good performanee that the handbook for the alarm organisation 
specifies the requirements for qualifieation and training (both initial and refresher) for 
personnel involved in SAM. 

The plant uses a specifie severe aecident simulator model that runs on a personal computer on 
a REEAP/SCDAP platform to train the ERO personnel in the use of the EOPs and SAMGs. 
The team considers this as a good practice. 

14.7 SEVERE ACCIDENT MANAGEMENT UPDATING AND REVISIONS 

The overall assessment of all existing plant SAM procedures and guidelines and the 
verification of the validity of existing analyses is a part of the PSR. The latest PSR 
(10EVA13) was finished in 2013. 

As new information has become available and based on the Complementary Safety Margin 
Assessment the plant recognized that some procedures and guidelines needed improvement 
and hence the corresponding measures to enhance SAM program have been included into the 
stress tests action plan and approved by KFD. These measures are either focussed on the 
overall assessment of the existing SAM procedures and guidelines and identification of 
possible gaps and the enhancement or the development of additional new procedures and 
guidelines. The survivability of some equipment that has been installed in the past for 
implementation of the SAM strategies has not been analysed to ensure that during all internal 
and extemal events it will remain functional. This delïciency has been recognized by the 
plant and the requirements for Systems enhancement are included in the stress tests action 
plan. The team encourages the plant to follow the requirements of the action plan and to 
implement all required measures. 

The team has recognized as a good performance that, together with the original vendor of the 
plant, a comprehensive matrix was developed to relate the individual stress test measures to 
each other and to demonstrate that all objectives are met. The matrix demonstrates that for all 
the defmed plant States (full power, mid-loop operation, refuelling and reactor core fully 
unloaded) the vital safety functions are fulfilled. 
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DETAILED SEVERE ACCIDENT MANAGEMENT FINDING 


14.3 DEVELOPMENT OF PROCEDURES AND GUIDEEINES 

14.3(a) Good practice: Requirements for SAM equipment in separate Plant Teehnieal 
Speeifieations. 

Plant equipment and features intended to be used for Severe Aeeident Management are 
described in the Plant Teehnieal Speeifieations (BTS in Duteh). This is a set of Teehnieal 
Speeifieations that is separate from the formal set of Teehnieal Speeifieations of requirements 
for the safety Systems of the plant (based on NUREG 1431), but they use the same strueture 
and layout. Availability requirements, allowed outage times, required actions and surveillance 
requirements are prescribed by this BTS in the same way as it is done by the formal Teehnieal 
Speeifieations (TS). The authorisation of the BTS is carried out by the plant’s Nuclear Safety 
Manager. Deviations from these self-imposed requirements are primarily reported to the 
Nuclear Safety Manager who is also authorized to grant exemption requests. The 
management expectation is that staff makes no distinction between the use of the TS 
requirements and the BTS requirements. 

Benefits associated with the use of Plant Teehnieal Speeifieations. 

The availability of SAM equipment is controlled in a similar way to the plant’s safety 
equipment. The management expectation that the BTS requirements must be considered as 
important as the Teehnieal Speeifieations requirements guarantees that the SAM equipment is 
not neglected but well maintained. The BTS also ensures clear requirements and SMART 
actions to maintain or restore AM availability. 

14.3(b)Good practice: Management of Severe Accident Management Guidelines (SAMG) 
process diagrams (PlDs) with coloured flow paths 

The SAMGs contain attachments with system line-ups that can be used to achieve certain 
flow paths (e.g. the non-standard flow path to inject water from the containment sump into 
the spent fuel pool by use of a residual heat removal pump). In order to assess and to 
configure these possibilities during an emergency, staff will mark the flow paths on process 
diagrams. This work is time consuming when several flow paths are to be assessed. Therefore 
EPZ has a complete set of up-to-date process diagrams available for every system line-up that 
is mentioned in the SAMG with the intended flow path marked by a coloured line. 

To consistently maintain a second set of PIDs and to keep them in accordance with the as 
built PIDs that are normally used is challenging. Deviations between almost identical sets of 
documents can easily occur. EPZ uses a CAD program to draw and alter all drawings 
including PIDs. The process diagrams are multi layered drawings. The coloured SAMG 
process diagrams are produced by using the existing digital PID layers of the according 
process diagrams and adding one additional coloured layer representing the intended flow 
path of the SAM guideline. Every time a process diagram is changed this is recorded in a 
database which directly informs the engineer which SAMG PIDs must be changed. Because 
almost all modifications to the process diagrams are minor changes, the SAMG PID can be 
changed by simply printing new copies of it based on the modified underlying PID and the 
existing coloured layer. Occasionally the coloured flow path has to be altered when a major 
change is made to a system. The use of the database ensures that every SAMG PID is revised 
when the underlying process diagram is changed. The revision number and date of the 
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original PID are also printed on the SAMG PID this enables an easy eheck whether the 
drawing matehes its souree. 

Benefits associated with the management of SAMG process diagrams. 

The use of eoloured SAMG PIDs guarantees easier and quicker assessment and eonlïguration 
of possible flow paths and error reduction in the interpretation of possible System line-ups 
described by the SAMG attaehments. The QA proeess for the management of the SAMG 
PIDs guarantees that the Information in these drawings is also up to date after a plant 
modifieation and in compliance with the as built PIDs. 
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14.3(l)Issue: The plant abnormal operation procedures and EOPs are incomplete and do not 
address the scope of all possible plant States. 

The team made the following observations: 

- Extemal event procedures are event oriented and do not address the impact of 
external events on safety functions; 

- No transitions from extemal event procedures to SAMG are identified and 
implemented; 

- The procedure for transition from the main control room to the emergency 
control room is very general and does not provide criteria and other necessary 
information for making the transition; 

Not all sets of SAM procedures and guidelines are implemented. The following deficiencies 
were identified: 

- EOF for spent fuel pool does not exist, only an alarm card for low spent fuel 
pool level is included in alarm response procedure; 

- Manuals for TAG to support CR personnel if “consult plant engineering staff ’ 
in EOPs is required, do not exist. 

- The plant specific procedures and guidelines have been developed based on 
the generic documentation and experience of staff. There is no formal procedure for their 
development (like plant specific author guides). 

Without a full set of SAM procedures and guidelines addressing all intemal and extemal 
events SAM could be ineffective. 

Suggestion: The plant should consider enhancing abnormal operation procedures and EOPs 
to ensure that procedures are complete and address all plant States. 

lAEA Bases: 

Requirement 19: Accident management programme 

5.8. An accident management programme shall be established that covers the preparatory 
measures and guidelines that are necessary for dealing with beyond design basis accidents. 
The accident management programme shall be documented and periodically reviewed and 
revised as necessary. It shall include instmctions for utilization of the available equipment — 
safety related equipment as far as possible, but also conventional equipment — and the 
technical and administrative measures to mitigate the consequences of an accident. The 
accident management programme shall also include organizational arrangements for accident 
management, communication networks and training necessary for the implementation of the 
programme. 

5.9. Arrangements for accident management shall provide the operating staff with appropriate 
Systems and technical support in relation to beyond design basis accidents. These 
arrangements and guidance shall be available before the commencement of fuel loading and 
they shall address the actions necessary following beyond design basis accidents, including 
severe accidents. In addition, arrangements shall be made, as part of the emergency plan, to 
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expand the emergency response arrangements, where neeessary, to include the responsibility 
for long term aetions. 


NS-G-2.15 


2.14. The approaeh in aeeident management should be based on direetly measurable plant 
parameters or parameters derived from these by simple caleulations. 

2.16. Severe aeeidents may also occur when the plant is in the shutdown state. In the severe 
aeeident management guidanee, eonsideration should be given to any specifie challenges 
posed by shutdown plant eonfigurations and large seale maintenanee, sueh as an open 
containment equipment hatch. The potential damage of spent fuel both in the reaetor vessel 
and in the spent fuel pool or in storage should also be eonsidered in the aeeident management 
guidanee. As large seale maintenanee is frequently earried out during planned shutdown 
States, the lïrst eoneern of aeeident management guidanee should be the safety of the 
workforce. 

3.27. Priorities should be set between strategies, beeause possible strategies ean have a 
different weight and/or effect on safety, and beeause not all strategies ean be earried out at the 
same time. In the preventive domain, the priority of the strategies should be reflected in the 
priority established for the critical safety functions. In the mitigatory domain, priority should 
be given to measures that mitigate large ongoing releases or challenges to important lïssion 
product barriers (where Targe’ means releases with levels of radioactivity that are above the 
general emergency levels, as defined in the plant emergency plan). The basis for the selection 
of priorities should be recorded in the background documentation. An example is a set of 
priorities that follows the evolution of many severe aeeidents; that is, the lïrst priority is to 
the lïrst fission product barrier to fail if no mitigatory measures are taken. The setting of 
priorities should include the eonsideration of support functions (vital auxiliaries sueh as AC 
and DC power and cooling water). 

3.40. Interfaces between the EOPs and the SAMGs should be addressed, and proper transition 
from EOPs into SAMGs should be provided for, where appropriate. Functions and aetions 
from strategies in the EOPs that have been identified as relevant in the mitigatory domain 
should be identified and retained in the SAMGs. Preferably, there should be no formal 
transition back from the mitigatory domain (SAMGs) to the preventive domain (EOPs), once 
the EOPs have been exited, although EOPs may still be used as judgement dictates. Where 
this is nevertheless applied, it should be ensured that the EOPs eonsidered are applicable and 
valid in the core damage domain, and that the decision making process includes all features 
neeessary in the core damage or mitigatory domain. As EOPs have been designed for a 
reactor with an intact core, they lose, in principle, their design basis in the mitigatory domain 
and, hence, should be exited. 

3.43. The transition point from the preventive domain to the mitigatory domain should be set 
at some time prior to ‘imminent core damage’ or at the ‘beginning of core damage’, or at 
some other well defined point (e.g. the execution of preventive measures has become 
ineffective or impossible). The selection of the transition point may influence the magnitude 
and/or sequence of subsequent challenges to fission product barriers. In sueh cases, this 
should be taken into account in the selection of the transition point which, therefore, should 
be placed at a point that is optimal for accident management. Where the transition point is 
specified on the basis of conditional criteria (i.e. the transition is made if certain planned 
aetions in the EOPs are unsuccessful), the time neeessary to identify the transition point and 
the possible consequences thereof should be taken into account. For example, the rise in core 
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temperature and the associated core damage that will occur during the attempts to prevent 
core damage should be considered. 

3.45. Proeedures and guidelines should be based on direetly measurable plant parameters. 
Where measurements are not available, parameters should be estimated by means of simple 
computations and/or pre-ealculated graphs. Parameters that ean be obtained only after 
carrying out complex calculations during the accident should not be used as the basis for 
decisions. 

3.46. Procedures and guidelines should be written in a user friendly way and such that they 
ean be readily executed under high stress conditions, and should contain sufficiënt detail so as 
to ensure that the focus is on the necessary actions. The procedures and guidelines should be 
written in a predelined format. Instructions to operators should be clear and unambiguous. 

3.69. For dedicated or upgraded equipment, there should be sufficiënt confidence in the 
equipment and, where possible, demonstration of its capability to perform the required 
actions in beyond design basis and severe accident conditions should be provided. 
Demonstration of the capability of equipment should be provided where other assessment 
methods cannot provide sufficiënt confidence. However, the level of qualification applied to 
such equipment need not necessarily be the same as that typically required for components 
and Systems that cope with design basis conditions. Similarly, requirements on the 
redundancy of such Systems may also be relaxed compared to the requirements applied in the 
design basis domain. 

3.71. Since the SAMGs depend on the ability to estimate the magnitude of several key plant 
parameters, the plant parameters needed for both preventive accident management measures 
and mitigatory accident management measures should be identified. It should be checked that 
all these parameters are available from the instrumentation in the plant. Where Instruments 
ean give Information on the accident progression in a non-dedicated way, such possibilities 
should be investigated and included in the guidance. 
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14.5 verificahon and validation of procfdurfs and guidefinfs 


14.5(1) Issue: Verification and validation of the SAM procedures and guidelines are not 
comprehensively described in any dedicated procedure and are not systematically conducted 
or documented. 

The team made the following observations: 

- The CRS is not able to simulate all plant States (e.g. shut down States); 

- There is incomplete validation of major changes of EOPs at CRS before 
implementation; 

- Formal cooperation with SAM technical owner (WEC) was terminated in 
2004 and since then the EOPs maintenance has been done by plant personnel. The 
alignment with PWR OG EOPs changes has been lost and hence the procedures may not 
be at the current industry Standard; 

- There were no dedicated sessions organized for EOPs validation at the full 
scope simulator, EOPs are validated during Standard operators training; 

- A process for EOPs modification is implemented and used, however no 
dedicated procedure for verification and validation exists; 

- SAMG verification was performed only during the development phase based 
on vendor's QA program, no later independent verification was conducted; 

Without systematic verification and validation the procedures and guidelines could lose 
integrity and potentially will not accomplish the original goal. 

Suggestion: The plant should consider implementation of the systematic verification and 
validation of SAM procedures and guidelines. 

lAEA Bases: 


NS-G-2.15 


3.99. All procedures and guidelines should be verified. Verification should be carried out to 
conlïrm the correctness of a written procedure or guideline and to ensure that technical and 
human factors have been properly incorporated. The review of plant specilïc procedures and 
guidelines in the development phase, in accordance with the quality assurance regulations, 
forms part of this verification process. In addition, independent reviews should be considered, 
where appropriate, in order to enhance the verification process. 

3.100. All procedures and guidelines should be validated. Validation should be carried out to 
conlïrm that the actions specilïed in the procedures and guidelines can be followed by trained 
staff to manage emergency events. 

3.101. Possible methods for validation of the SAMGs are the use of a full scope simulator (if 
available), an engineering simulator or other plant analyser tooi, or a table top method. The 
most appropriate method should be selected. Onsite tests should be performed to validate the 
use of equipment. Scenarios should be developed that describe a number of fairly realistic 
(complex) situations that would require the application of major portions of the EOPs and the 
SAMGs. The scenarios encompass the uncertainties in the magnitude and timing of 
phenomena (both phenomena that result from the accident progression and phenomena that 
result from recovery actions). 
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3.103. The findings and insights from the verifieation and validation processes should be 
documented and used for providing feedbaek to the developers of proeedures and guidelines 
for any necessary updates before the doeuments are brought into force by the management of 
the operating organisation. 
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14.6 TRAINING NEEDS AND TRAINING PERFORMANCE 


14.6(a) Good practice: Plant specific Severe Accident Simulator 

The plant has a speeifie severe aeeident simulator model that runs on a personal computer. 
The model runs on a REEAP/SCDAP platform with a user friendly interface consisting of 3 
separate sereens. One sereen is an instructor sereen to eontrol the simulator, the other two 
sereens only present plant parameters that are also presented in the main control room. The 
REEAP model is eopied from a REEAP model that was used to perform formal safety 
analysis of the plant design by the original plant designer. Neeessary safety Systems and a 
simple secondary system were added to the original model to make a working simulator for 
training purposes. The simulator was tested and validated against the safety analysis reports 
made by the vendor. Overheating, gap release, melting and reloeation of the modeTs reaetor 
eore are simulated by the SCDAP part of the model. 

Benefits associated with the Plant specific Severe Accident Simulator. 

This SAM simulator is used to train the Emergeney Response Organisation in the use of the 
EOPs and SAMGs. The simulator is also used to develop severe aecident seenarios for 
exereises in whieh the CRS is used. The CRS stops before fuel damage starts so exereises 
with use of the CRS ean only be extended into eore melt region when pre ealeulated data 
from the SAM simulator is used to ‘simulate’ the part of the seenario from where the 
simulator is stopped. Aeeident progression ean also be studied with the SAM simulator to 
estimate the possible outeomes before formal analyses are requested from contraetors. 
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15. CORPORATE FUNCTIONS 


15.1 CORPORATE MANAGEMENT 

The organisational structure including responsibilities and lines of authority have been 
delïned and communieated in relevant documents of the organisation. It is divided between 
the organisation, the plant and the supporting organisation. Tasks and responsibilities are 
deseribed in task deseriptions and proeesses and procedures of the management system. The 
Management Board consists of the Chief Executive Offïcer (CEO), (who is also the license 
bolder for Borssele NPP and represents the operating organisation) COO, CEO, head of 
support services, referred to collectively as the organization. Fuel Cycle Management, 
Nuclear Safety, Quality Assurance, Procurement, Regulatory compliance and legal affairs and 
communication report directly to the CEO. A Chief Nuclear Officer CNO is not part of the 
organisation. The CEO reports regularly to the Shareholders meeting on behalf of the Board 
of Directors. 

The shareholders agreement does not contain separate rules about Nuclear Safety. The 
shareholder agreement enables the CEO to have the authority to work and react in respect to 
nuclear safety and is appropriate to his position as license bolder. 

Key senior management changed considerably since 2010. The position of the plant manager 
has changed four times during that time. In 2012 the position of the plant manager was 
divided between the responsibility for production and nuclear safety. This was necessary due 
to an interim manager having no nuclear experience. The Head of Nuclear Safety is not part 
of the independent oversight. A list of changes from organisation and plant managers in the 
last 5 years was observed. Organisations managers have less experience (2 years) in nuclear 
operation, while plant managers have gained experience between 7 and 10 years in nuclear 
operation. 

A systematic approach for succession planning of corporale and line managers was 
implemented in August 2014 based on a set process (sec Human Resources). 

ESTABLISHING POLICIES, EXPECTATIONS AND INFLUENCING PRIORITIES, 
PRACTICES, BEHAVIOURS. 

A 3 year business plan is issued yearly by the organisation. It is a result of the objectives of 
the shareholders and the organisation’s own objectives, it is communieated to the staff of the 
organisation and its implementation is reviewed by the organisation quarterly. Existing and 
possible risks are assessed in an integrated risk management methodology, sorted into 
different risk classes and associated with the objectives. The team recognized a Good 
Practice in this respect. 

The results of the 3 year business plan are transferred to middle and long term actions. 
Attached to the business plan is a list of the planned investments. Non-technical projects, 
known in the plant as programmes are not included in a summarized list. The plant’s annual 
plan by Nuclear Operation, Financial sector and Support Services are elaborated every year. 
For departments more specific objectives and indicators are listed. Low level indicators are 
not developed at this stage due to the on-going implementation of the Integrated Management 
System. The annual plans also include the rough resource planning of the department. Non- 
technical projects in which staff members participate are mentioned. The ratio between daily 
operational work and additional work for non-technical projects (programmes) and technical 
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project is not obvious. An increased work load could lead to a reduced attention on Nuclear 
Safety. The team made a suggestion in this respect. 

Objectives in the performance evaluation forms of the staff often use high level indicators or 
general tasks, which are not or not easily translated in reasonable personnel contribution to 
Nuclear Safety. Individual Performance Indicators (IPI) or objectives for applying HP tools 
for workers and IPI’s for supervisors to encourage workers to use HP tools are not 
suffïciently included in task descriptions and performance evaluations. Without implementing 
an effective communication of objectives and goals, the contribution of individuals will not 
meet the expectations of the management. The team made a recommendation in this respect. 

Organisations managers participate in a “Managers in the Field Programma” (process PU- 
NOl-03 from 31.03.2014). In 2014 for Management walk downs, 3 of 5 organisation 
managers and 10 of 66 managers missed the goals substantially. 

MONITORING, DECISION MAKING AND CORRECTIVE ACTIONS. 

A System of inspections, evaluations and assessments is implemented to ensure, that 
activities, processes and performance of Nuclear Operation is in compliance with existing 
requirements. The organisation monitors this in different steps. 

The organisation is informed daily about the plant status using a form. Relating to Nuclear 
Safety, only one Fundamental Safety Function (Confinement of radioactive releases) is 
mentioned. The team encourages the organisation to address all three Fundamental Safety 
Functions to get a comprehensive view on Nuclear Safety. 

An integrated management system is in the implementation stage. Process owners are 
dedicated to the processes; processes reviews are not systematically conducted by all process 
owners to ensure continuous improvement. Some processes do not have indicators to evaluate 
their effectiveness. The status of the indicators is reported monthly to the organisation. 
Indicators are highly aligned to the KPIs from e.g. WANG. Eow level or process indicators 
do not exist in a structured way at this time due to the development of the Integrated 
Management System. The result of review and analysis of indicators is sent monthly to plants 
management and process owners and quarterly reviewed by the organisation. The team 
observed that the Pis are not always assessed in a stringent matter. 

A QA programme for audits performs 10 to 15 audits / year on average. For 2014, 11 out of 
12 audits have been performed to date. The number of audits in 2014 is reduced, because 
external assessments like WANO, OSART and Lloyd are considered in the program. In a 
database the results and non-conformances are recorded. Two major non-conformances from 
2011 and February 2014 are still pending. Also some minor issues from 2009 are not 
resolved. 

2 yearly and 10 yearly report of self-evaluation of changes and results in organisation, staff, 
operations and technique have been performed since 1994. The team reviewed the last 2 
yearly reports from 2011/2012. The report includes a considerable number of suggestions for 
improvement made by the plant and is shared with the regulator. Some suggestions from the 
report have not been added to the corrective action list of plant management as required. 

A structured form is used for decision making in the organisation. 41 decisions have been 
performed in 2014. The effectiveness of this has not been evaluated up to now. The team 
encourages the plant to review the effectiveness of the decisions and the decision making 
form appropriately. 
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A corrective action list is maintained by the plant management (process A01-24-N201). Since 
2011 remaining aetions are deereasing slowly (209 - 127). The status is reported monthly to 
the plant management and the indieator owners and monitored by 4 indicators; three of them 
are not meeting their required values. The process description describes input, output, task 
owners and the use of success/effïciency criteria. 127 active aetions are grouped in three 
priorities A (4), B (97), C (4), 22 are not prioritized. The list is updated on demand, the 
performance indicators (PI) are updated monthly. The process requires that corrective aetions 
of the 2 yearly reports have been integrated in the related plant management list. Due to 
missed input data like the owner of the action and execution date, this is not done. 
Performance indicators are reviewed in the organisations management quarterly. No effective 
corrective aetions were taken by the organisation related to this issue. The team has issued a 
recommendation in this respect. 

PROVIDING RESOURCES CONSISTENT WITH RESPONSIBILITIES. 

The 3-year business plan and the annual plans of the sectors provide the scope for the 
investment plan and the staffmg plan. Since 2009 staff has greatly increased especially in 
those departments related to the plant. 

The organisation does not include a Chief Nuclear Offïcer. Functions related to Nuclear 
Safety are the CEO as license holder, the Head of Nuclear Safety as member of Plant 
Management and the Nuclear Safety Offïcer as member of Quality Assurance in the role of 
independent oversight. The Head of Nuclear Safety has to review the Nuclear Safety related 
activities independent from oosts and Schedule considerations. His operational unit has no 
directly assigned work forces to allow him to have flexible focus on important issues 
additional to his daily work. This has been recognized in the FOCUS 2 project and assigned 
workforce is plarmed in this context. The organisation is encouraged to keep this and to 
support the Head of Nuclear Safety discharge his responsibilities. 

MANAGEMENT OF CHANGE. 


For organisational changes affecting Nuclear Safety the plant performs an organisational 
change process PU-AOl-08. The objective is to assure that the organisational changes 
concerned will not reduce or have a negativo impact on Nuclear Safety. This safety 
assessment is performed by the plant quality assurance (QA) department. The process has 
been used twice in the frame of FOCUS 2. The last resulting report is focused on the 
comparison of the proposed change related to national and international regulations and 
existing plant documentation and does not comprehensively assess the impact on Nuclear 
Safety. The team has made a recommendation in this respect. 

15.2 INDEPENDENT OVERSIGHT 

The Independent Nuclear Oversight Offïcer (INO) reports to the manager of the Quality 
Assurance department. His role as INO is not a full-time position, as he is also developing 
QA tasks and functions. He has formally got direct access to the CEO, although this access 
has never been used to discuss safety issues to date. Direct access to the CEO would only be 
used if escalation was needed. Safety issues are in the first instance discussed with the plant 
management or with the Head of Nuclear Safety or, in some occasions, in the Plant 
management meetings. These options have been used several times. 

There is no formal plan for the INO inspection tasks during normal operation; an 
“organisation-sensitive” approach is followed instead of periodically assessing Standard 
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processes. The INO focusses on the areas providing some kind of weakness or potential issue. 
The process to conduct his role is deseribed in the procedure PU-A02-31. According to this 
procedure, the inspection plan is based on organisational goals, risks, incidents and signals 
coming out from operation and the organisation. For every outage period, an INO inspection 
plan is issued. 

The recommendations issued by the INO officer in his reports are not always incorporated 
into the corrective action programme and are not always traceable. INO does not track them 
for completion, as that is the responsibility of the individual departments. 

The status or results of the Human Performance Programme, leadership and culture issues 
and the adequacy of human resources are assessed in the yearly safety assessment in the 
Intemal Reactor Safety Committee in which the INO officer holds an independent position. 
Another person in the QA department (the Operational INO officer) focuses on plant 
operations, whereas the INO officer assesses the fullilment of safety policies. 

The INO officer does not perform a systematic follow-up of some of the main challenges of 
the station, such as the FOCUS-1 project and the implementation of the work management 
process. INO has reviewed some technical projects, such as the MOX-project (report 1403). 
No process to assess the effectiveness of the independent nuclear safety oversight activities 
has been defmed. 

The team encourages the organisation to further develop the role of the INO and to reinforce 
all the above mentioned tasks in order to ensure that the INO assesses the level in which 
safety standards are maintained and improved. 

15.3 Human Resources 

The organisation supports the plant management by the Human Resources department in the 
area of strategie recruitment, management of change and organisational development (team 
coaching, individual coaching). Those issues are also part of the non-technical projects 
FOCUS 1/2/3. 

Key competences are kept intemalized and made accessible by a register of core functions, 
for which 36 have been developed. Task descriptions include a job profile with requirements 
for the job (including soft skills) and how they are or will be fulfilled. These documents are 
easily available in the document management system of the company. To ensure the 
availability of the appropriate number of competent staff a systematic approach is in use 
within the process for the succession planning PU-All-04. The process has been 
implemented in August 2014, up to now 5 of 7 steps have been performed. 

PROVIDING COMPETENCE, KNOWLEDGE MANAGEMENT. 

The organisation secs their role in providing the register of competence. A more specilïc 
knowledge management is performed in the TQ section in 2 fields: 

- Educational and work experience; 

- Plant specific experience. 

The organisation has implemented an individual performance assessment to evaluate annually 
the performance for each staff member. This is validated by an indicator, which is well in line 
with the required value. 
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The objectives in the task deseription observed to Nuelear Safety are not always based on the 
direet eontribution of the employee to Nuelear Safety or easily translated into personnel 
objectives. The team observed that individual objectives are often issued as high level 
indicators like Total Core Damage Frequency, number of scrams, reports to the regulator, or 
unavailability. A survey from Human Resources in the task descriptions or performance 
evaluation forms shows that the use of Human Performance Tools, which contributes directly 
to Nuelear Safety, is not sufficiently included. The organisation has already started a non- 
technical project to provide support to the staff identifying their eontribution. The team has 
issued a recommendation on this topic. 

LABOUR RELATIONS AND UNION AFFAIRS. 

A manager of the organisation is the designated spokesman to the workers’ council and the 
unions. He communicates mainly with WENB for the collective bargaining (now a contract 
for two years) and the EPZ worker’s council (how to reward performance assessments). 
Alcohol tests are randomly performed at the entrance “loge” or 100 % on the access road. 
Until now, drug tests are not performed. The plant is not concerned about expected strikes of 
key operational personnel. 

Employee surveys have been performed yearly from 2005 to 2010 and in 2013. 407 out of 
550 staff member participated. No surveys were planned for 2012 and 2014 due to the 
scheduled SCAV and OSART missions. A large number of the results of the last survey are in 
known range of other employee surveys done in the Netherlands. Organisation and the plant 
are considered as good employers, but more than half of the employee feel affected by the 
reorganisation. The organisation is using this information to adjust communication and 
performance assessments. 

15.4 COMMUNICATION 

The communication department reports directly to the organisation. It was founded in 2001 
and since the event in Fukushima an additional person has been employed; 

It is active in the area of intemal communication, extemal communication and crisis 
communication. Communication is established as process A21. lts maturity has been 
checked. Stakeholders’ satisfaction (intemal/extemal receivers) has been checked since 2011. 

The communication staff are professionals. They are included in training courses to better 
understand the surroundings they report on and can attend any meeting they would like to 
attend. 

The Intranet provides channels to encourage, monitor and address employees providing 
feedback on the organisations/plant initiatives e.g. on FOCUS 2. A considerable number of 
messages were given by the organisation via the Intranet about FOCUS 2. The management 
asked for response, but did not receive any; 

The communication department strives for the participation of general company staff in 
communication to open channels to get feedback about staff opinions on plant action. The 
organisation is encouraged to enhance its efforts to receive feedback on its programmes and 
initiatives; 

The communication department uses own company staff for communication and 
development of communication tools. This increases the acceptance of the tools and makes 
messages more authentic. The team has issued a good practice on that topic; 

Based on the areas for improvement from WANO and SCAV reviews, the communication 
department is participating in the development of the tooi “My eontribution to Nuelear 
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Safety”. The objective is to translate global objectives for Nuclear Safety into the 
contribution of the different levels of the staff. The development of the methodology has 
started with a first pilot and will be rolled out for the objectives in 2015; 

Communication is part of the crisis management organisation. A crisis communication plan is 
established and used for drills. It is available in the document management system. s The 
document is reviewed every year. A contractor is available to support communication in the 
case of a crisis. 

15.5 CORPORATE SUPPORT FOR INFORMATION TFCHNOFOFGY (IT). 

Safety related IT Systems are utilized in FPZ in the Business application (BIS), Technical 
application (FIS) and Security application (SIS). None of these Systems have a direct 
connection to the reactor control or the reactor protection Systems. 

In the CM area the BIS was observed, which is conducted by the department Information 
Technology. An annual plan with performance indicators (PI) is issued for incident 
management, problem management, configuration management, version management, 
change management and license management. Monthiy reports about the status of the 
indicators in these of the areas are sent to the organisation. The indicators were checked 
without concerns. 

The organisation has outsourced the service (servers/network, clients, infrastructure) to OGD 
and the Technical Application Management (TAM) of software to ATOS. These tasks are 
monitored by weekly or monthiy meetings. 

A document which includes adequate rules goveming the testing and acceptance of new 
software is in the development phase (70 to 80% readiness of the Use Cases) at the plant. The 
team encourages the plant to further enhance the development of these rules. 

Backup processes are performed by OGD on a daily and weekly basis. A clearly arranged 
procedure for back up processes exists in the QS system of CO. The tape backups are stored 
in lire proof safe in the CO archive and the NO archive. The CO archive is not equipped with 
fire detectors or lire extinguishers. 

Specific training is given to the staff for new applications and how to preserve knowledge 
about exist applications to maintain knowledge in Borssele NPP. 

15.6 CORPORATE SUPPORT IN PROJECT EXECUTION 

The organisation created a department for the management of projects in 2011. The term 
project is understood clearly by the organisation as the execution of a technical modilïcation 
or change. Changes, e.g. in the organisation, in Human Performance or continuous 
improvement are conducted in plant management. Those non-technical projects often are 
communicated as programmes. 

Technical projects are recorded in common lists (e.g. Fong Term investment Eist). Budget, 
milestones and risks are reassessed and communicated. 

The organisation has realized that an extensive and improved reporting for technical and non- 
technical projects is needed. The team encourages the organisation to continue the started 
improvement in project management and to assess if the intended objective of creating a 
project department has been achieved. 
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For non-technical projects (programmes) the team observed a less effeetive approach. Not 
exeeuting non-teehnieal projects, especially in changing organisation and behaviour of staff 
not in an effeetive manner may impact Nuclear Safety in continuing operation. The team bas 
issued a suggestion in this respect. 

15.7 LICENSING AND REGULATORYINTERACTION 

The organisation and the plant management bas regular meetings and contacts with the 
regulator. This is mainly performed by the CEO, the Head of the Quality Assurance and the 
Head of Nuclear Safety. Actions resulting from regulatory visit or assessments are 
transferred in a database, which follows the actions and reports to the organisation. 

The regulator does not intervene in the daily nuclear operation, hut monitors the progress of 
modification e.g. if the modifications on the polar crane, the portal crane outside of the 
reactor building and the turbine building exceed the deadline the regulator will impose a 
penalty. 

Following the plant’s process for Change Management, the regulator is informed about those 
changes and a decision is expected. During interviews managers stated, that the regulator or 
conditions in the license do not require a decision or approval of the regulator as a result of 
the Information. The organisation should define clearly its process in relation to the expected 
response of participated parties or organisations. The team has issued a recommendation in 
this respect. 
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DETAILED FINDINGS IN CORPORATE FUNCTIONS 


15.1 CORPORATE MANAGEMENT 

15.1 (a) Good Practice: Integral risk management 

EPZ has a risk management oflïcer who is responsible for development and control of 
integral risk management within the organisation. Integral risk management is the umbrella 
for all types of risks. 

The starting point for the risk management is the strategie goals in the business plan. Integral 
risk management has the seope nuclear safety, industrial safety, plant availability, fmance, 
complianee and employee satisfaction and assesses strategie risks, process risks, project risk 
and aspect risks as security and fraud. 

The objective of EPZ is to integrate risk management in the processes. Risk management is 
already in use in the business planning process, the management decision making process, the 
portfolio management process (prioritizing), project management, operational experience 
(prioritizing), the administrative organisation and information security. 

Risks for the strategie goals are classifled with the EPZ risk matrix. The impact areas in the 
risk matrix are linked to the strategie goals and severities of the impact areas are balanced. As 
a result of this the response strategy is balanced. Risks are registered in a database. Main risks 
are reported every 3 months and discussed in the management team and in the shareholders 
meeting. 
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15.1(1) Issue: The expected contribution to Nuclear Safety for the aehievement of the 
organisation’s objectives is not effeetively determined, communicated to and understood by 
the staff. 


Although the organisation has started to develop a related programme the team observed the 
following: 


- Objectives in the performance evaluation forms often use high level 
indicators (e.g. Total Core Damage Frequency, number of scrams, number of fNES 
reports) or general tasks (preparation of OSART mission), which are not or not easily to 
translate in reasonable personnel contribution to Nuclear Safety; 

- Reviewed performance evaluation forms from staff members on 
different working levels shows vague or more global goals on the lower working levels; 

- Low level process based indicators, which could be used as an 
objective in task descriptions, are not yet developed; 

- A survey by EPZ Sector Human Resources showed that the use of 
Human Performance Tools, which contribute to Nuclear Safety, is not implemented and 
required yet in the performance evaluation forms of the staff. 

Without implementing effective individual objectives and goals the contribution of 

individuals will not meet the expectations of the management. 


Recommendation: The organisation should enhance the awareness of individuals conceming 
the relevance and importance of their activities and of how their activities contribute to 
Nuclear Safety in the aehievement of the organisation’s objectives. 


lAEA Bases: 


SSR-2/2 


3.2 Promoting a strong safety culture. 

Strategies and management objectives shall be developed in accordance with the policy in 
order to put the policy into effect. 

Policy making for all areas of safety, which includes: 

- Setting management objectives; 

- Establishing the policy for safety; 


107 


CORPORATE FUNCTIONS 



- Developing management and staff who value leaming, have skills in 
creating, aequiring and transferring knowledge, and ean adapt the organisation on the 
basis of new knowledge and insights; eorreetive actions and making improvements; 

- Promoting a strong safety eulture. 

GS-R-3: 


3.2. Senior management shall develop individual values, institutional values and behavioural 
expeetations for the organisation to support the implementation of the management system 
and shall act as role models in the promulgation of these values and expeetations. 


3.3. Management at all levels shall communicate to individuals the need to adopt these 
individual values, institutional values and behavioural expeetations as well as to comply with 
the requirements of the management system. 


3.4. Management at all levels shall foster the involvement of all individuals in the 
implementation and continual improvement of the management system. 


3.8. Senior management shall establish goals, strategies, plans and objectives that are 
consistent with the policies of the organisation. 


3.9. Senior management shall develop the goals, strategies, plans and objectives of the 
organisation in an integrated marmer so that their collective impact on safety is understood 
and managed. 


3.10. Senior management shall ensure that measurable objectives for implementing the 
goals, strategies and plans are established through appropriate processes at various levels in 
the organisation. 


4.4. Senior management shall ensure that individuals are competent to perform their assigned 
work and that they understand the consequences for safety of their activities. Individuals shall 
have received appropriate education and training, and shall have acquired suitable skills, 
knowledge and experience to ensure their competence. Training shall ensure that individuals 
are aware of the relevance and importance of their activities and of how their activities 
contribute to safety in the achievement of the organisation’s objectives. 
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15.1(2) Issue: Corrective actions are not treated in accordance with plant procedures and not 
controlled effectively by the organisations management 

- In plant management corrective action list is used (process AOl-24- 
N201). The process is reviewed by four indicators; 3 of 4 indicators do not meet their 
threshold; 

- 3 priorities (A, B, C) are defined. In priority A two non-conformances 
from 2011 (outage preparation) and February 2014 (EPP responsibilities) are pending, 
which are not fully implemented and dated; 

- The CEO as license holder and representative of the operating 
organisation uses the indicators of the plant management list to review quarterly the 
corrective actions. Although 3 of 4 indicators for the plant management corrective action 
list did not meet their objectives no action was taken by the organisation; 

- The process requires that corrective actions from the 2 yearly 
evaluation report for the years 2011/2012 are collected in the plant management list. The 
report is requested by the regulator. A considerable number of deviations have been 
recorded in this 2 yearly report. The suggestions made by plant management have not 
been recorded as corrective actions in the plant management list as required by the plants 
process. This is due to missed input data like owner of the action, success criteria and 
fmalization date. 

Without implementing, regularly reviewing and assessing corrective actions to carry out the 
activities connected to nuclear safety in the organisation, the plant will miss opportunities 
achieving its goals and objectives and improving safety performance. 


Recommendation: The operating organisation should implement, regularly review and 
assess an appropriate corrective action programme to monitor and review the safety 
performance. 


lAEA Bases: 


SSR-2/2 
Requirement 9: 

Monitoring and review of safety performance 

The operating organisation shall establish a System for continuous monitoring and periodic 
review of the safety of the plant and of the performance of the operating organisation. 


4.37. The appropriate corrective actions shall be determined and implemented as a result of 
the monitoring and review of safety performance. Progress in taking the corrective actions 
shall be monitored to ensure that actions are completed within the appropriate timescales. The 
completed corrective actions shall be reviewed to assess whether they have adequately 
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addressed the issues identified in audits and reviews. 


GS-R-3: 

6.11. The eauses of non-eonformanees shall be determined and remedial aetions shall be 
taken to prevent their reeurrence. 


6.12. Produets and proeesses that do not conform to the specilïed requirements shall be 
identified, segregated, controlled, recorded and reported to an appropriate level of 
management within the organisation. The impact of non-conformances shall be evaluated and 
non-conforming produets or proeesses shall be either: 

- Accepted; 

- Reworked or corrected within a specified time period; or 

- Rejected and discarded or destroyed to prevent their inadvertent use. 

6.13. Concessions granted to allow acceptance of a non-conforming product or process shall 
be subject to authorization. When non-conforming produets or proeesses are reworked or 
corrected, they shall be subject to inspection to demonstrate their conformity with 
requirements or expected results. 


6.14. Corrective aetions for eliminating non-conformances shall be determined and 
implemented. Preventive aetions to eliminate the eauses of potential non-conformances shall 
be determined and taken. 


6.15. The status and effectiveness of all corrective and preventive aetions shall be monitored 
and reported to management at an appropriate level in the organisation. 


6.16. Potential non-conformances that could detract from the organisation’s performance 
shall be identified. This shall be done: by using feedback from other organisations, both 
intemal and extemal; through the use of technical advances and research; through the sharing 
of knowledge and experience; and through the use of techniques that identify best practices. 
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15.1(3) Issue: The change management process is not effectively used to support changes in 

the organisation. 

Although a ehange management process (PU-AOl-08) is part of the Integrated Management 

System (IMS) of the station the team observed the following: 

- FOCUS 2 is processed as a non-technical project (operational 
programme). The resulting document for FOCUS 2 assessing the impact on Nuclear 
Safety does not address for example the total workload imposed on the organisation to 
implement the changes in parallel with continued operational activities; 

- Steps in the process are not defmed appropriately (e.g. classification of 
importance of changes, integration of and expectation to the regulator, feedback cycle for 
given comments) and could be misinterpreted; 

- Task descriptions, which include functions and responsibilities of 
sections that had changes in 2009 (e.g. Plant Manager NO and Head of Nuclear Safety) 
have not been promptly updated. Some task descriptions have been reviewed with a 
considerable delay; 

- No preliminary safety evaluation was performed prior to the 
implementation of the role of the Head of Nuclear Safety Section; 

- The Intemal Nuclear Safety Committee has given comments on the 
proposed changes. The feedback about resolving their comments is rated as not satislïed. 

Without conducting an appropriate change management processes the organisation cannot 

ensure a safe and effective transition. 


Recommendation: The organisation should use and implement the process for managing 
complex organisational changes. 


lAEA Bases: 


SSR-2/2 


3.2 The management system, as an integrated set of interrelated or interacting components for 
establishing policies and objectives and enabling the objectives to be achieved in an efficiënt 
and effective manner, shall include the following activities: 


(b) Allocation of responsibilities with corresponding lines of authority and communication, 
for: 


Allocating resources; 

Providing human resources with the appropriate level of education 
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these 


training and material resourees; 

Retaining the neeessary competences; 

Approving the eontents of management programmes; 

Developing proeedures and instruetions, and having a striet poliey to; 
Adhere to these proeedures and instruetions; 

Setting polieies on fitness for duty; 

Establishing a programme to make the neeessary changes to any of 
Functions on the basis of the performance in achieving objectives. 


GS-R-3 


5.28. Organisational changes shall be evaluated and classified according to their importance 
to safety and each change shall be justified. 


5.29. The implementation of such changes shall be planned, controlled, communicated, 
monitored, tracked and recorded to ensure that safety is not compromised. 


GS-G-3.1 


5.60. For changes for which it is judged that potentially significant effects on safety could 
arise, assessments should be carried out to ensure that the following factors are considered.... 


5.61. Senior management should develop a specific process to manage and review 
organisational changes. The process should ensure that there is no degradation in the safety 
culture of the organisation. 


5.67. The total workload imposed on the organisation to implement the changes in parallel 
with continued operational activities should be given careful consideration. 
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15.4 COMMUNIC ATION 


15.4(a) Good Practice: Engagement of own employees in the performance of intemal and 
external communication / virtual tour on the organisations website 


DEVELOPMENT OE COMMUNICATION TOOES. 


EPZ consult staff for suggestions or new tools for communication, as they know hest where 
improvement is needed in the communication on the shop floor to develop their engagement. 

On safety communication a working group, which consists of representatives of several 
departments ‘Tt is your safety too!” comes up with suggestions for the communication of 
actual safety themes (e.g. special toolhox presentations, articles for the intemal magazine, 
illustration for the sereens). An example is the short movie ahout Nuclear Safety, which 
marked the start of the yearly outage and was highly appreciated hy employees. 


CONDUCTING INTERNAE & EXTERNAE COMMUNICATION. 


EPZs Communications department uses only EPZ’s own employees in all intemal and 
external communication tools. In this way the tools are recognizahle for EPZ staff, the puhlic 
and interested parties. The use of pictures of colleagues creates hoth engagement with their 
colleagues and pride. Employees can show their contribution to a corporate culture 


THE ORGANISATIONS WEBSITE INCEUDING EACT SHEETS 
AND VIRTUAE TOUR. 


Organisations website offers a virtual tour with plant pictures and pictures of their own 
employees. EPZ website is open for questions from the public, which are promptly addressed 
with reliable, factual information in a comprehensible way. EPZ factsheets and illustrations 
are often used by the media and will be used by the regional authorities for purposes of crisis 
communication. 
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15.6 CORPORATE SUPPORT IN PROJECT EXECUTION 


15.6(1) Issue: The management (planning, eoordination and treatment) of non-teehnieal 
projects (ealled programmes) is not struetured eonsistently with the treatment of teehnieal 
projects. 


Operational projeets include teehnieal and non-teehnieal initiatives e.g. to enhanee Human 
Performanee or to implement organisational ehanges. For the eoordination of teehnieal 
projects a specific department was founded, it uses a struetured process and professional 
methodology as base for its work. However the team observed the following facts: 

- In interviews managers described the different treatment, defmition and information 
between teehnieal and non-teehnieal projects (ealled programmes); 

- No integrated action plan with a complete list of non-technical projects is available at the 
corporate management; 

- Resources required from departments for projects are assessed in depth only for several 
large teehnieal projects; 

- Middle management stated that they receive less periodic or comprehensive information 
on the status of budget, the results, risks or mile stones of the non-technical projects; 


- Priorities for non-technical projects and contributions are not based on a risk assessment 
and not fully identified. 

Not to coordinate and treat non-technical projects in accordance to appropriate standards may 
impact Nuclear Safety in continuing operational activities. 


Suggestion: The organisation should consider reinforcing the eoordination and treatment of 
operational non-technical projects appropriately. 


lAEA Bases: 


GS-R-3 


5.1. The processes of the management system that are needed to achieve the goals, provide 
the means to meet all requirements and deliver the products of the organisation shall be 
identified, and their development shall be planned, implemented, assessed and continually 
improved. 


114 


CORPORATE FUNCTIONS 



5.28. Organisational changes shall be evaluated and classified according to their importance 
to safety and each change shall be justified. 


5.29. The implementation of such changes shall be planned, controlled, communicated, 
monitored, tracked and recorded to ensure that safety is not compromised. 


GS-G-3.1 


5.60. For changes for which it is judged that potentially significant effects on safety could 
arise, assessments should be carried out to ensure that the following factors are considered. 


5.61. Senior management should develop a specific process to manage and review 
organisational changes. The process should ensure that there is no degradation in the safety 
culture of the organisation. 


5.67. The total workload imposed on the organisation to implement the changes in parallel 
with continued operational activities should be given careful consideration. 
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ANNEX 1: THE OSART SAFETY CULTURE ASSESSMENT METHODOLOGY 


INTRODUCTION 

Safety culture assessment differs from other types of assessment in that it requires a deeper 
understanding of the underlying organizational and cultural issues behind what is explicitly 
observed and reported. A safety eulture assessment does not lead to a clear-eut and easily 
actionable result, but will lead to an increased understanding of why different issues related to 
safety appear. 

Safety culture needs to be understood in the light of its complexity. No safety culture is 
perfect; every organization bas its areas for improvements. The objective of a safety culture 
assessment is to identify positive practices and areas that need attention. 

METHODOLOGY 

The methodology used for the safety culture assessment is divided into two parts sequentially 
divided: 

A descriptive part to identify the cultural expressions (facts') and themes and 

A normative part to evaluate cultural themes (issues^) against the lAEA framework of safety 
culture. 

The critieal aspect of the methodology is to hold the descriptive and the normative analyses 
separate until the fmal part of the assessment. This ensures the identifieation of the vital 
aspects of the culture before the scope is narrowed into the lïxed normative framework. It is 
essential to avoid a check-list-type-of-audit, where the assessors are directly comparing the 
findings against the normative framework in the initial part of the assessment. 

The following six methods are used to collect data: 

- Doeument review; 

- Questionnaire; 

- Interviews; 

- Focus groups; 

- Observations; 

- Team findings. 

The figure below describes the methodology analysis process. Each method for collecting 
data is treated separately to ensure validity of the results. The normative analysis starts when 
the overarching issues are identified. Earlier in the process the data collection and analysis 
are performed in a descriptive manner. 


1 To align with the OSART terminology eultural expressions will be named facts 

2 To align with the OSART terminology normative eultural themes will be named issues. 
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The lAEA ISCA Analysis Process 



Final Issues; Normative, 
evaluative analysis 
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data 


Proper implementation of a safety culture assessment requires five critical elements: 

- Theoretical basis; 

- Valid methodology; 

- Appropriate expertise ; 

- Descriptive data; 

- Intemationally recognized safety standards. 

Within the assessment three senior management workshops are conducted to ensure a shared 
understanding of the fmdings and results. 

BASIS OF THE RESULTS 

The results of the safety culture assessment are based on: 

- Document review of the Advanced Information Package for the O SART as well as 
additional documentation requested during the on-site data collection; 

- The lAEA Safety Culture Perception Questionnaire administered to all the employees 
associated with the organization; 

- Interviews representing all different functions and organizational levels; 

- Focus groups conducted across the organization representing all departments and levels; 

- Observations including regularly scheduled meetings, shift tum-overs, work activities and 
plant tours; 

- All the team lïndings in the daily reports of the OSART missions were included. 
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DESCRIPTIVE ANALYSIS 


The descriptive analysis was conducted using the Schein (1992) model of eulture. 

According to Schein’s three-level model, an organization’s eulture can be assessed by 
evaluating the organization’s artefacts, values, and basic assumptions. The metaphor of an 
ieeberg is often used to help explain the concepts. Above the level of the water, on the first 
level of the model the organization’s artefacts are found. Artefacts are the observable signs 
and behaviours of the organization and represent only a small portion of the whole culture. 
Below the surface of the water is the second level that consists of the organization’s values. 
Examples of values might include such things as, “safety first” or “maintaining an open 
reporting work environment.” Deep in the water and the majority of the ieeberg is the third 
level which contains the basic assumptions of the organization. Examples of basic 
assumptions may include, “safety can always be improved” or “everyone can contribute to 
safety.” The organization’s basic assumptions are less tangible than the artefacts and values. 
They are often unconscious and taken for granted within the organization sharing the culture. 



Figure 1: Schein’s model of the levels of eulture 
NORMAHVE ANALYSIS 

Once the descriptive analysis was completed the team compared the overarching themes with 
the lAEA Safety Culture Normative Framework describe in the Safety Standards GSR3, GS- 
G-3.1 and GS-G-3.5. 
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DEFINITIONS 


DEFINITIONS - OSART MISSION 

Recommendation 

A recommendation is advice on what improvements in operational safety should be made in 
that activity or programme that has been evaluated. It is based on lAEA Safety Standards or 
proven, good international practices and addresses the root causes rather than the symptoms 
of the identified concern. It very often illustrates a proven method of striving for excellence, 
which reaches beyond minimum requirements. Recommendations are specific, realistic and 
designed to result in tangible improvements. Absence of recommendations can be interpreted 
as performance corresponding with proven international practices. 

Suggestion 

A suggestion is either an additional proposal in conjunction with a recommendation or may 
stand on its own following a discussion of the pertinent background. It may indirectly 
contribute to improvements in operational safety but is primarily intended to make a good 
performance more effective, to indicate useful expansions to existing programmes and to 
point out possible superior alternatives to ongoing work. In general, it is designed to stimulate 
the plant management and supporting staff to continue to consider ways and means for 
enhancing performance. 

Note: if an item is not well based enough to meet the criteria of a ‘suggestion’, but the expert 
or the team feels that mentioning it is still desirable, the given topic may be described in the 
text of the report using the phrase ‘encouragement’ (e.g. The team encouraged the plant to...). 

Good practice 

A good practice is an outstanding and proven performance, programme, activity or equipment 
in use that contributes directly or indirectly to operational safety and sustained good 
performance. A good practice is markedly superior to that observed elsewhere, not just the 
fullïlment of current requirements or expectations. It should be superior enough and have 
broad application to be brought to the attention of other nuclear power plants and be worthy 
of their consideration in the general drive for excellence. A good practice has the following 
characteristics: 

— Novel; 

— Has a proven benefit; 

— Replicable (it can be used at other plants); 

— Does not contradict an issue. 


The attributes of a given ‘good practice’ (e.g. whether it is well implemented, or cost effective, 
or Creative, or it has good results) should be explicitly stated in the description of the ‘good 
practice’. 
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Note: An item may not meet all the criteria of a ‘good practice’, but still be worthy to take 
note of In this case it may be referred as a ‘good performance’, and may be documented in 
the text of the report. A good performance is a superior objective that has been achieved or a 
good technique or programme that contributes directly or indirectly to operational safety and 
sustained good performance, that works well at the plant. However, it might not be necessary 
to recommend its adoption by other nuclear power plants, because of fmancial considerations, 
differences in design or other reasons. 
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LIST OF lAEA REFERENCES (BASIS) 


- SAFETY STANDARDS 

SF-I; Fundamental Safety Principles (Safety Fundamentals); 

GSR Part 3; Radiation Protection and Safety of Radiation Sourees: International Basic 
Safety Standards, Interim Edition; 

SSR-2/1; Safety of Nuclear Power Plants: Design (Specific Safety Requirements); 

SSR-2/2; Safety of Nuclear Power Plants: Operation and Commissioning (Specific Safety 
Requirements); 

NS-G-l.I; Software for Computer Based Systems Important to Safety in Nuclear Power 
Plants (Safety Guide); 

NS-G-2,I; Fire Safety in the Operation of Nuclear Power Plans (Safety Guide); 

NS-G-2,2; Operational Limits and Conditions and Operating Procedures for Nuclear 
Power Plants (Safety Guide); 

NS-G-2,3; Modifications to Nuclear Power Plants (Safety Guide); 

NS-G-2,4; The Operating Organisation for Nuclear Power Plants (Safety Guide); 

NS-G-2,5; Gore Management and Fuel Handling for Nuclear Power Plants (Safety 
Guide); 

NS-G-2,6; Maintenance, Surveillance and In-service Inspection in Nuclear Power Plants 
(Safety Guide); 

NS-G-2,7; Radiation Protection and Radioactive Waste Management in the Operation of 
Nuclear Power Plants (Safety Guide); 

NS-G-2,8; Recruitment, Qualification and Training of Personnel for Nuclear Power Plants 
(Safety Guide); 

NS-G-2,9; Commissioning for Nuclear Power Plants (Safety Guide); 

NS-G-2,II; A System for the Feedback of Experience from Events in Nuclear Installations 
(Safety Guide); 

NS-G-2,I2; Ageing Management for Nuclear Power Plants (Safety Guide); 

NS-G-2,I3; Evaluation of Seismic Safety for Existing Nuclear Installations (Safety 
Guide); 

NS-G-2.I4 : Conduct of Operations at Nuclear Power Plants fSafetv Guide) : 

NS-G-2,I5; Severe Accident Management Programmes for Nuclear Power Plants Safety 
Guide (Safety Guide); 

SSG-I3: Chemistry Programme for Water Cooled Nuclear Power Plants tSpecific Safety 

Guide) : 
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SSG-25: Periodic Safety Review for Nuclear Power Plants fSpecific Safety Guide) : 

GSR; Part 1 Govemmental, Legal and Regulatory Framework for Safety (General Safety 
Requirements); 

GS-R-2; Preparedness and Response for a Nuclear or Radiological Emergency (Safety 
Requirements); 

GS-R-3; The Management System for Facilities and Activities (Safety Requirements); 

GSR Part 4; Safety Assessment for Facilities and Activities (General Safety 
Requirements 2009); 

GS-G-4,1; Format and Content of the Safety Analysis report for Nuclear Power Plants 
(Safety Guide 2004); 

SSG-2; Deterministic Safety Analysis for Nuclear Power Plants (Specific Safety Guide 
2009); 

SSG-3; Development and Application of Level 1 Probabilistic Safety Assessment for 
Nuclear Power Plants (Specific Safety Guide 2010); 

SSG-4; Development and Application of Level 2 Probabilistic Safety Assessment for 
Nuclear Power Plants (Specific Safety Guide 2010); 

GS-R Part 5; Predisposal Management of Radioactive Waste (General Safety 
Requirements); 

GS-G-2,1; Arrangement for Preparedness for a Nuclear or Radiological Emergency 
(Safety Guide); 

GSG-2; Criteria for Use in Preparedness and Response for a Nuclear and Radiological 
Emergency; 

GS-G-3,1; Application of the Management System for Facilities and Activities (Safety 
Guide); 

GS-G-3,5; The Management System for Nuclear Installations (Safety Guide); 

RS-G-1,1; Occupational Radiation Protection (Safety Guide); 

RS-G-1.2; Assessment of Occupational Exposure Due to Intakes of Radionuclides (Safety 
Guide); 

RS-G-1.3; Assessment of Occupational Exposure Due to Extemal Sources of Radiation 
(Safety Guide); 

RS-G-1.8; Environmental and Source Monitoring for Purpose of Radiation Protection 
(Safety Guide); 

SSR-5; Disposal of Radioactive Waste (Specific Safety Requirements); 

GSG-1; Classification of Radioactive Waste (Safety Guide 2009); 

WS-G-6.1; Storage of Radioactive Waste (Safety Guide); 

WS-G-2.5; Predisposal Management of Low and Intermediate Level Radioactive Waste 
(Safety Guide). 

- INSAG, Safety Report Series: 
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INSAG-4; Safety Culture; 

INSAG-10; Defence in Depth in Nuclear Safety; 

INSAG-12; Basie Safety Prineiples for Nuelear Power Plants, 75-INSAG-3 Rev.1; 
INSAG-13; Management of Operational Safety in Nuclear Power Plants; 

INSAG-14; Safe Management of the Operating Lifetimes of Nuclear Power Plants; 
INSAG-15; Key Practical Issues In Strengthening Safety Culture; 

INSAG-16; Maintaining Knowledge, Training and Infrastructure for Research and 
Development in Nuclear Safety; 

INSAG-17; Independence in Regulatory Decision Making; 

INSAG-18; Managing Change in the Nuclear Industry: The Effects on Safety; 

INSAG-19; Maintaining the Design Integrity of Nuclear Installations Throughout Their 
Operating Life; 

INSAG-20; Stakeholder Involvement in Nuclear Issues; 

INSAG-23; Improving the International System for Operating Experience Feedback; 

INSAG-25; AFramework for an Integrated Risk Informed Decision Making Process; 

Safety Report Series No.11; Developing Safety Culture in Nuclear Activities Practical 
Suggestions to Assist Progress; 

Safety Report Series No.21; Optimization of Radiation Protection in the Control of 
Occupational Exposure; 

Safety Report Series No,48; Development and Review of Plant Specific Emergency 
Operating Procedures; 

Safety Report Series No, 57; Safe Long Term Operation of Nuclear Power Plants. 

- Other lAEA Publications 

lAEA Safety Glossary Terminology used in nuclear safety and radiation protection 2007 
Edition; 

Services series No. 12; OSART Guidelines; 

EPR-EXERCISE-2005; Preparation, Conduct and Evaluation of Exercises to Test 
Preparedness for a Nuclear or Radiological Emergency, (Updating IAEA-TECDOC-953); 

EPR-METHOD-2003; Method for developing arrangements for response to a nuclear or 
radiological emergency, (Updating IAEA-TECDOC-953); 

EPR-ENATOM-2002; Emergency Notification and Assistance Technical Operations 
Manual. 

- INTERNATIONAL LABOUR OFFICE publications on industrial safety 

ILO-OSH 2001; Guidelines on occupational safety and health management Systems (ILO 
guideline); 

Safety and health in construction (ILO code of practice); 
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Safety in the use of Chemicals at work (ILO code of practice). 
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TEAM COMPOSITION OF THE OSART MISSION 
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Years of nuclear experience: 29 
Review area: Operations 1 

SHARRETT, Lance- United States of America 

Palo Verde Nuclear Power Plant 
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Years of nuclear experience: 26 
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Review area: Technical Support 
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Slovenian Nuclear Safety Administration 
Years of nuclear experience: 9 
Review area: Operating Experience 

HALE, Heather- United Kingdom 

EDE Energy - Nuclear New Build 
Years of nuclear experienee: 12 
Review area: Radiation Proteetion 

LENGYEL, Andras - Hungary 

MVM Paks Nuclear Power Plant ETD. 
Years of nuclear experienee: 10 
Review area: Chemistry 


LEMAY, Francois - Canada 

International Safety Researeh 

Years of nuclear experienee: 29 

Review area: Emergency Planning and Preparedness 

HONCARENKO, Radim - Czech Repnblic 

CEZ, 

Years of nuclear experienee: 28 
Review area: Severe Aceident Management 

HAAGE, Monica - lAEA 

Years of nuclear experienee: 11 
Review area: Safety Culture 

HABER, Sonia - United States of America 

Human Performance Analysis, Corp. 
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